<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="239">
<package pkgid="62f5e73f3daab99d4242b64e9ecbb2061f632dd25ac852370618ab394f92c768" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="ddc020488868e8596649e17e84931371d814da7752857f4179e327803f640d54" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="2607fdb0941fe5dd24f8b67a595c3f1c932ad704dff65994d08ebe56a9f7fbb8" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="6946bb2ae0f1b57997642b53b5b8e101f6e8a451d1797cba0588f186ed43b9a4" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="6db35dad6e569cad70b6551971aec9a6c2053c04c3d8d4988be3f27b83ad0a62" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="4bb62787514507d3d88ecc444dde470053397dcd9d2cdb5b141fb60ae65a8e7c" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="1f0167dc6a3f8a992c3443928828afe67965850215df863134ecb5667acc3d3b" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="ae95eef42d4942b8e19331680fd83868f5b988fc5023de710430a0e702198239" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="6929f8670a646eb90bd23a759bef9c672bc47d3d1c14931c6cf9128a15897936" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f7115f46e3cde9a0f4df6f0ef31f2d17b3d483df191de6d5a0bb8a103aca03c9" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b3fd9a8d439eb2ff4c14ca126770f5d2b1c05564437ac20c8b971b0c32d9998e" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="363062de0e5bd83789bdcfae76bae624b4f9207b49063beb5c38801d3e8df5c8" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e21fb325b387730891c5b3f2576369e76275e23b9aa278fe5375cc81d85a3698" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="91a6231ecc8a4ed34dbc4471b9ff67c6b3027dcf744765318c745d74091fa48e" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e5b8208afe5ef1229dff923b9a547957120edf1d91c0208d509c7e5e6db95b0e" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="318afcc5f7937c5cb12e5fd2a7bab279239ea4d691154aadd511bc2887bb8555" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="780e639627735ae726dffdc914cde98756fd40c643ced90e0b46e86a5b9c3231" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e1d21337310b5201233cfe7fff3a0a845354824301365a122911a811dfa34098" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b7a1c7d181fbb170d449776093d8ffe425b5b0e87f66d1bb51813eda5fbb88b9" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="46d9e73610eb471492ff18212b50215b520c85a1656fdc2588141fcf3c16fdf2" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="a7b642b12f2e594dfe72656843fd1144bcaaacfa8df52ba0b511fff9090181e4" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b2b00f744dd1fc8d8ec55f439a0ad3dd0236e16582bfb23eba1ac50764933cf0" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="9776033470ab4d3a66493ddac41141baaf57d1990c1ecacdd17260a1f5666372" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="6b02953b9602a6f4240e9e18f9cbb7dd2c68d876ac465bf46c9dbc3d4642ebae" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="686a525bb2acf7788f622fa9130f6967a4fe2f221470b0267bae12de04be67ca" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="752c53730e3c5b1faf3ec7a2adcc28ccf03e6e986edf617ad0e251a38a93fa17" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="71fe0deb1c62fa2dce05f33cd5961cb261d3c0ddf2a34eb9dd95d172dff4ea36" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="776808c1a6d3bc0cebcf1b3475ddc5b7235592ae036f5242faec20c996625b09" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3271824f4ad71cbc0464e3eeef1e13ad4b31616395a84873017ae9c73044aabc" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="65ef05b01d780ba8c99f107c92440f984bc3fd08c63450f11feeba634d505559" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="7cd9c9a2001ac0b7151d301e1c8b0f6901d00719e1c1a3b4b13febf87d7bae95" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a5b76d8ecf74c8cc218321236793564a0368dab4a5c8574175bca8dba57f4d92" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="7a56986c2c3764867a856ade625324a7c338abb5140adc79033c63f9d1126362" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e0598aab49d3461dedd9d6e4b243ba5b69fab189b7eebe837f5a9617348c2e6e" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="9b13f9008eda1032bf7101b9fb083b22fbb394064b3898124b5dab37165fc362" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3be5ffb8f38dcddb980d0cbfd98e7dfda53ebccb68db60c054cb1b12ca594fa5" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="dc39d564e6ac26da792e68fa7148fef90d21fa0bccec3c0eb55ba96142888f8f" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="9583e260a0aef1652bc029c67e891636a899527f66122643926ac5c2d7a2bc67" name="kernel-rt-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3f63762e5b517f9fa9bbdf132fba1c5f63900904437df75a726751a3f0fe56ec" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="55d7c6d946dd2e38f3d7137cf0a59ad84204afc79a9351c3e50fdf5234471e8e" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="c1744e060b45d46ad35cfa2cc9491d48ff9b1b74c19d545c11b7fc12b3fc693e" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="57bc337127abb2d9ded7a64b4f420799baccbba3bb4325b05b74551125bf8532" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="140773d3a1ab99da0598ab8db68a36d94c66fd496bdd673172b5d3d44c577913" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="adbfe66a9c61e337f1b3e7a01411c4e33ec9c2e71e9e2ad90219c16388a80e09" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="dcdfd7f3c37061c6741b3523db0da71b84b1b784c7c4e37b78dc48d14ab101a0" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a0254ff06824d0a2c0e70c1ccbc7a06b6f15e7db03cec0bd57a78af73c3ccae4" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="68c2235d28055a9bc33429d36c80bb92b81c11e01db388e2b57708bd98c1cacd" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="2cea05ef5a3bacbdc7cff4e4a961532014c5a697cd50da9f6a678b7c042b21f6" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="ea4ba186bec57a713b5a3a0a68c1b01648341b354c31cf7c9684dac252e0fd97" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="ca21b2afd5d35f969e5e7c15c75b55a526333f9b28064ac76bf888d9e0a53cd7" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3d5b3440db8a5a2819b374805455f4a5aaff9766dae7c43114877c80951b2158" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3865ddd54ed09c651f75daebd6ca4efc0adaa8ba2cca98bbeca551b4b6e909c0" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="1b8510a4c49ff92e224257b21bfc0ee86883e765152cea5dafd5b73a22cb64f3" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="57117b624a7b07e5bc369deb0c3946b93e2e7ab8e6bb7d068f5fae18b4c6c8c1" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="0192c2018a23fc3fc360cbcbfc87212c69ab89eead2813447ed2ac654b07bf0e" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="771c2531caf7f135aa102caa0a86007873001271fd090125be88ad5c02448775" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b39aacc86c42b1d441a3c7289ffbd088fc1fc5dd16c58e47e357202196be8f82" name="kernel-rt-debug" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e3d13f90e83b9f9f28ddedfb2292383da0b93dcd0546b1e2c07c2862d08065d6" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="1590d892d72fdf504b1844c93184279478b7f8220f4573a7afbd8b754d53e673" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3872b217d9e0c949e6f4cf8a80f4fe56ba3ce39f948056807e99d2ffc0b7841c" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="14ef5ccc6cc1023923b7e2718a847d48039aa313b827337105e269a963463de3" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="aa857b4c7f2e322cf71e9dfee8151f98620f462f7bd05b9d04be49ea4a5442f6" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="5ce5086d7e03742ebe0b0f750cdb9f2fb691465557072da949789e7641aeb98c" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="58241935644432eaa143f9548f22c1f2b1ccb09d8721afb80b5f0391a7ae387e" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="28ae95fcd2eab1049a3a9c1b094fee676522c53d75734d124d4eaebd51845a01" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3d6f2efb65999c9e609f220ff4ce4360b2bb0297838e33c8d42a5f8311997395" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="07745534e680115c66a553b581452aa00b25a27aecdaf4a920f3a0c214d0bf14" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a024b35d10d8703e81b03a2325736a4b6076b1bfc48ba025692eabeb25283b17" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="90c8712f7ca299535ee530a8d2d437e795e7b8f07448e6af085e0f37354d8ef8" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="1de14b98b00283e74d6d3ba20ea26591d1f1e99911f2575055c506f11e6d6909" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="11a4452be9cbb989e1a3c920e395c56d2aacc01ea7096e1c4ffdb898007d0ff6" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="86f26bdb11ffc2b1552f25e25a22fbb35f6383d09a104680154e1bf1632613f9" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="029d67206932553e9e285778a9e07a9ff6146e67ed5f5431db2f85e67168e26d" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="46c61f61dffde44db7759905a0cf8c6a2c4c60a51931345ed488c37b1543b090" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="fa9b5a5f5de7da049cfb228ed64b453b6ad3b888fd6e75900c21b958e3d0892a" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="812dd64021ecd9a31741b9131c7f0f7e2644b251afe63114e8bfcdfd8b57afff" name="kernel-rt-debug-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="293c0c1c73b46a3c80d99607ef8baba4552379df624ae9cc3e8f976217a78c7f" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="3304b2b4cfefd8481901812f4c3f5c26446f89a3f813d0ebcc86789051696e95" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="6c2a23e12c552f3d46138023b353e3834a6944d04b2932b5d79bb0fe181e9bcc" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="033a7cffb74077f65551d8dbeb545a57b84c440a6d777ca03f7169fc96ebcc31" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="528f3e9506136011133ac47a182621022893a13dab302d9055639eb3e86f88e2" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f887f5bbf0dd8d024b01b5adb5d69a77325dd4c3370b103a01ca1decf178bba8" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e5411de3f33c5c00b719fe82b9018ebad461f2ca59eabb3669e2ca7d9da0756e" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="81e45d7343fb133a48ce0ef73381814ecce9d739887f7d8dc61d1fa387d4e313" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="c33a422e07f924dddfe784024d552fe317d8650a943ca3c8c36662ecd972d6d3" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="dfbc8da6572501436372eb62a25138a6e96514a46206628b5df67eaccdf5a070" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="365c685017d678aef8ce7e22f9d39d410aaea2d6bc166a3a13c4e16dfa8c5cef" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="61abaae5cefd30dbe5ad5b75972572b2b97c5341b61dd624cd4a49614cc5212c" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="8ca01e1a148394f0e1391773ccd95568d225c695aa38d2b890cc75e707961385" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="0006625a0c34242a3055981bf54e6cacdf7947ee4e13de82be97e28173778293" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="5cc75391686f9450e2cead7b75fa9954c40bc67bdabe27175c5f8bb1c6e1dd91" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="58de60a13d9307eec2a4c0c1f4ce2e9f522ae78f0bd3b5a265b1900bf27c3dc3" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="2e02c19119d76a4bca5cac93639a649afbf901546b993e22212613adda3565f6" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="1084cdf3c9737e970dbc5f0814966e016f8bacb5112e432c6abcde4eecf2e296" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a5c62b33f9e5698c44c376eb281caff001b2d4eeef1db27ff02745e8feea0097" name="kernel-rt-debug-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f9732bb8a25c21e126eeb08e53c28332591054430da10f5436f9ba74f8f7304f" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="4794e34de5f9e39b3dc0001966b04a8b557df95c7b59632062eecaff9c5390d0" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="bf5d6c73b2fce1f6879f47a8264fc77922e6439a3e1cab4a3212a08484eda6dc" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="bb5f89c4937f5efe951f6be5fd84cd7534598c3790489726c4ade67a0e56bd63" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f00344d8eaf1d270378749a6d1845e0d40b9ff529ce7d2a17a317331e32e1260" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="0d2c614464a0c6f41c4383c0446ae44a1822c8f4ed1f571684c489af20408de3" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="90c796346c7f39e70bdca76f7e848d3d70e76cf81d7a50c6ed42551eb3e7a2fd" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f342859d0e6118a1a5fa46648bb03c4012829d7e76818a2670af9226e45c978c" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f6b9684f5b33a7d429a4aeb7f2f2b0e6a826f053adacaceabd7cff783aaf52ee" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="38830dd8f75fcc49b60f948a2b27eba268d75d900eb75cf9bfa903a6a03d3cad" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3de4da7f84f5214dec3a9d45f45a65b244da29f51c602e74bb13ab25cea057e6" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b6c40b3cba29eea395248d1f27c18c62456d67cc7c6d222db0be64ff9c44bb61" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="5161a89803020bbca89913b6d2f7898b1bbc8870733aca7415a4f1e8af2f45b3" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f1d11819ebcd04eebd9e509990df6265bced8fc68ab154ecd316f339ce7c817d" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="572746b5a57f0b0282792cf3b9577c24c0d49b5a4a95143513fe69dbfcb9c6dd" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="93741ff2244229ce9b4e4e158e8f79f9e4c9f7d91c87955076401a8463c1423a" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="ad1e8256736b7dd660e6494a77a131dcffb4eb740fc8408d71458cfa4ac64898" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="fcd8ae3f1e38fb3458271e861dbe3f73cf79324c983bf1b6d08cefaec46186d3" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="44ccf96063f4f97806e0b8c47eeca19ecea3f96c1b1abaa4578eb53cc5fd5016" name="kernel-rt-debug-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="27ee0d8438352757f7f378c735b099ee2ea16822626f42de4075e3e661704f47" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="61afcf7e4116bb8643248ade9f47b8437dc6c9f8d4d8d0cf40003c9e1d6bf328" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="2122898680dca8f0814697794d7baf8f9675b2f7b4eacf780aeb13a3efcbedbd" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="89c5524c107e73c8bdc41c931580922caf3807cf771aa199fd8fc4e150a181b1" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="fc6eb22e189d4b592390e9db635cf1174931bdc5113c47b9cab99d0bbff191ac" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="00dcf1fa934c9401efcc80de648e3a918730f97f4c966ccb98247e7dc5689a3b" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="80607ef151cd9150053b130894768e0fdd0870addb20280588e68628855e71ce" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="c68e6ebe0af493db7d25f916dc15a4bded056782d59aff2cd8dda4f2045bcea8" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="6472ebbf52f6534f079a77cd7579edfd32d1c1d011769855c897184f82083a71" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="51d746689109ae9216f2e282274cf6514b1c7ec1a73bc2037a3e2ba52d5e1319" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="be73e8d0459af13d6b2ced3a428645bdf6c9ddeee4a0ae8b23fda1eb7eb31c65" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="cee35de8698fe467297164788de892a7f52b79a0a9672d937c6952a8f227e91a" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="17342b99c58a639ea2fdefdf764998b5a8df93736ee4362302533d978625e5c8" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b4ba295665c4f1d56cd01238403d70d74435d57cceceb10a7aa80ac2d26b23bd" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="38600129412d6a9ceddc5d3a59456bd507a962136258ea5574615bb09ea4cfbd" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="1e451174124280ad444893f641301e500139c5c470914ce29e171f5f14e6cfb9" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b2fb2a649686f9181f69ad028a969fd285a19ed9c81281a570c27c3dba19ec90" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="81543de9f3e724042788c500fbb2f1de31d00f647559ee54f0f3c693606df925" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3373ef6084ddd90988f98e94d0c4e9ec7879f5d47248436254d9572d4bf22490" name="kernel-rt-debug-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="2b35c50be8613fd051abe9b2508bdc02024541b4a7487d61bf0b8d3feef587f3" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="b50ba237993919272f2dc0328b29e298b48ca07809b10e1fdcd39b509a3b2f1f" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="9065828421591a7ace2ba4126d80cf91c2447fc6944314dd3ffc83f8c3754a82" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="fcf6d76ceb87f7370d98236e7f3f8c2f8d495451b1b459868c457aed476561de" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b6edcfc119eefdbcb8dba139b33fe0e66e7eeca32fc0aba19dd3f41f8000d5bd" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="69633155c8cc38c49211a29ea382e9829388bb2ff6ffc3ed1bdda79ce4bad1d1" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="30f7d0b990e2bca89ee740fe257d158b454efbae1e44f38ecc9c0e99402ab454" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="8fdd3ba2178d42c9b95f5cf4dfa7677028a7fbce608bc7d5bf74078064c995c1" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a38952ead5b82e6a05e1026226de2b618b74f8b42c7f06a6f0c35cb54921f2e6" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="559f87ef43b8274a20faede1654ef6c2f9692d4bae900177f7b95fa4c29b3577" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="fab2261dcce6cdaad3e8e085b318d6143c165630ad0b99229ed4382a0fb97901" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f53915721b3063a06a721bacb40072f5d867b389ada88dd73080b25989b5f3c9" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="14702550b6d26c907a9be3d3f9c4a235002d2151af4302c645c1e2fd60c3f91c" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="c0f022864ea2c8bca32ae43a2ac1c4fc47943960cfe345ba4553acc1741b09b3" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="74a1f31452b8adb0e2988ec038c87978d498ff2f7d2469f49b58f3ea7613e4ef" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b7c59f4bcd2c372d680372c8f0375eae43888f3ae85c3319423e63ddb67a34ec" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="63676489dfb22a6baf6df3aff16125a4d142bf6174fb56ad95757940b319237a" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="4258c2ead7ae3d568e60491b6fcd2cec9652639507ad02798c10f7e4d1798b31" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="7a56a0555ced92015b9c740587c88b2c91777190820595efd39ca0ce9fcaf06a" name="kernel-rt-debug-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="394fc3f9d9dfb68a8e20970a045988bd5f4cb3bea79159213eeb245c93b51135" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="4f5afa177af2f4f655883eeb2f10a2916f6e2aa3a930c250d263f6b271f39bdf" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="7310a4830d39c8d72f408a9c1fecb13034038a18e0d1839550346123d9a8b15c" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="4d28cfc53cb84a42f725c8dd1bc9a28b0c62657bdbe2d5fa442c7197cf583812" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e788643d40679d1e81593e99d45101850757040b5a535784034b000b593ea9a3" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="7971383023b2a4b63aba086bc7aef5139a24fc7c37404c2abca3bfe942b884f3" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="2ec8b44de8859bcb3cd4c90b0124c6a1b3592c3e999ff4bdfea050edc68ab9a4" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f08277dd536df19d50c8499ec05aa00cc7f3b25e5357936c00a367bfe28d83c5" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="ce1e23f5aed17f112c244223c29aaed10c89f908da2d097901b53592996b1a0a" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e6d4c8b4a047223834a8876370daef7c37ac6a9d8ebc9652e306ef482e804ee0" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b7c6beaea306b162980a142810cf254380a342f0901fecacd449167d97733128" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="0a51e842f64048d0ace1c81510a4a46c39df7079423b9ed1d7a15f92bc97de85" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f8c5dc9b3c73eabd83a923241a10bf27365a68db307e62dee90e53a205ed8326" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="6899713995b058e7a41310ce04f37f75889d63ed9ee4f2224bfd59d614a036db" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="7f9eb286f7105a00db44d1e9aece3aea388512b671278245d82bfc56220f84fe" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a50668e888f98ff3184ffcad386c3a080616a46fc6f714c31b7155052a2ebcb2" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3308cffdffca62a81481145db8baaaa922e9ed4dd601a5991103b2065e9805f9" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="1158f188e9aedd7563710260d0ded4c06b0ce04966916815dfcf68abe96de5f0" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="d6f61af0c21d506b2fe41a9143ae007c214e9fbbbaf9e196617a8a6d8e7da6b3" name="kernel-rt-devel" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a7c9012fa8cd0f11f900c18eb00b87a4ba50a17d588cacc8e9b49351e4fe6bf5" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="4599654c67b12703cdc6eaf356328cb48cb91d340a8f2b84a408be28a0802a28" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="44fb665c4b1cf935f3a3101b16422b7dc43db6dbf974ca220163862b7d25c6f7" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="288cb2811f7748048fc38c20834b591a5873f06460b7cd8507f47ed1bbd66e30" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="5353121be859150d6c439c9dc85894a5662c2957e6ad81b7a1a4a7301e212e62" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="056b6a2b9e059bf570d826879e1698429300d25a53b544deca3a5e2064af0a95" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="09e1b90bf74fbf13c56e5a14a59757970a6eb961c1ff26739c8106e8252ca83d" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="620decd447fbb396161132132a20776ca8d76c455f0108576ee7cd40b2acaabd" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b810cdbe3d43b674ec410553ea9f92e397b101abef1ef92de3eca6d4d2a3f702" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f0a68a07d405d7fefa13768f4ada564ac935028363c245de53ab2215db6da807" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a45cce9719de8a8d43aae11441536a45f390a920dc5239422673debd67c60ea0" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a1628ec3ac3159c3bb83255469a9281f264abeb5134892cae3f1bd5e3f70dae9" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="9196833285bd21bd74136f26257581fbe0b07b6a8f942632cb2a738425348180" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="bd62b052aae31a498dda6e3a5ca42a14a0eca86c48a132f947207a99f835a34c" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="acbd49093581f8dab03d0185c304c72313bb70eb496cf919e171e67fd1012d4c" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="d30f872bc93c41adb0738b6d52026b1878edfacf45a0b9fddd25c9957517c27b" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a3693913b67a0456101aa2f865085959708e0be246cf44a61fb7a0d16d0aa904" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="76bb2d2d0ac97c37a8c1abe68a8f195bdd2142ad0f70bca904bd0e4b8c2f1614" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="ea5ccfdc79966a68b22469d2e019bff57a754da7378304a060ef54b399638aa5" name="kernel-rt-modules" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="44848ad7711897891c27d92ed016e1496acb2e804e33583fa26bf8522af32423" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="0b3f4021077295081a9b21116563fadf5fea6eb6a3ad139fd71513110db4d057" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="aec4c374ef59d5ebad624245b24014af7d72dad74d524cc8952656ee2270f10d" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="974fbee8ddaa81b800b60a601609609c58b721e60c60589c535dd3913d950e0f" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="05c23164b1743c050036fa523cdd73a60cc9f4a3ec95391a9301bca2ed083501" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="bedab67f2d986adcbeb0f036fbacb9d5481a885945b51db9bad6df3ff6e05d95" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e0f923c85658e46db056a3b2b4d995fa5b40931336ca6518fe117ace3c952357" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="03cbe972d63728f85382dd3d15cd5090033ba93c99fda0bf64af634f70b9f69c" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="22bc0685fe28a4ef5d1f0ad140e7759f69bfaa1e9bbfff5d07b72a64d7be51ab" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="d58ed5a3ebd835afa9ecc744cecbe73e78e1c1a33250a696105f371af5e4c706" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="705a5c1bf22aa51031d06a287a146f52c2696230e344699ee25bba38ffc977fd" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="08f9169041fa713e408ea11f73b9f702b02cd45017c77dda808440d01dfed93d" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="ac03b952eb5ca12bbcfa217bf9dedc8cd26063b05ceaf91079ff38b8595dafb6" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="94ef04ecf34781d8efe721aed73bac65ce4673621e6126e5ccb2a204ca7798fc" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="4885d8bfdc3411915c8ad7bc8cc4b33c8162b799a0c0f5c81a022745389dde2b" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="132fef1cc4b53ca28c3c77271a5fb4f213b159426cb59a7b2895e2aa99ed0bee" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="6306e818d794d303f0cde38e4471715a14d764d1b3310940e83f6e27b14ae754" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="a4e6891240998eaf4d0af2040b7996e22ccbfbcee21361adecd7c373aac22e53" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="3b3c146de7c8ba2d088764ceb442737335a4058065bd6ca5d5d463c0fbcd06e5" name="kernel-rt-modules-core" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="d541eefb5c2be5faf3f8c8e99b500859fbcd610b009180615c19bb6c6ea20b1a" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.16.1.el10_2.0.1"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.9.1.el10_2]" date="1776686400">- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.16.1" date="1779278400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
  <changelog author="Jonathan Dieter &lt;jdieter@resf.org&gt; - 6.12.0-211.16.1.0.1" date="1779537600">- Bump release for updated rocky-sb-certs</changelog>
</package>
<package pkgid="ab8fefddc64719ae9f19aea08989f7fcc29be701e9ded03b443c20ec1eba2988" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.18.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.10.1.el10_2]" date="1776945600">- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.11.1.el10_2]" date="1776945601">- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.12.1.el10_2]" date="1777291200">- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.13.1.el10_2]" date="1777550400">- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.18.1" date="1779969600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e195c8b5441c91d72228e9219ab7fc906a62904f1d2e0113eda59a03d6fee1d9" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.22.1.el10_2"/>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.14.1.el10_2]" date="1777896000">- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]</changelog>
  <changelog author="Patrick Talbert &lt;ptalbert@redhat.com&gt; [6.12.0-211.15.1.el10_2]" date="1778500800">- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.16.1.el10_2]" date="1779105600">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.17.1.el10_2]" date="1779278400">- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
- mm/page_alloc: clear page-&gt;private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: explicitly block -&gt;setattr() (Rafael Aquini) [RHEL-171617]
- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "lpfc: don't use file-&gt;f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.22.1" date="1781179200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b9fd9d5b4131999f6c8d81f530af4bc1c913c55196af066b60b4f445a3bdbfd1" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.26.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.18.1.el10_2]" date="1779364800">- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.19.1.el10_2]" date="1779969600">- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322}
- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903]
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903]
- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903]
- Bluetooth: hci_conn: Fix using conn-&gt;le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903]
- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903]
- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903]
- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175821]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930]
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302]
- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366}
- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.26.1" date="1781956800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="e18b74a3577af1485b25f7652fe007016d84834d32c8fb18eccfce09dcc6f8ab" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.28.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.20.1.el10_2]" date="1780401600">- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243}
- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469]
- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950]
- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613}
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.21.1.el10_2]" date="1780574400">- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473]
- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473]
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518]
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.22.1.el10_2]" date="1781092800">- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov)
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932]
- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932]
- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932]
- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932]
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932]
- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054}
- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501}
- ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037}
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581}
- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467}
- can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532}
- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.23.1.el10_2]" date="1781179200">- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.28.1" date="1782475200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="81e08c6714e5fe1eaef22253d2817608aaa8bae0eb23fd59c5952a557dfd2e05" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.32.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.24.1.el10_2]" date="1781524800">- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723]
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127]
- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495]
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056}
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474}
- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787}
- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.32.1" date="1783598400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="34882e011e6de91ad2ce26faa062a2cdc78320a00f88ef12f48244784b960499" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.33.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.25.1.el10_2]" date="1781697600">- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann)
- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299]
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299]
- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.33.1" date="1783944000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="f52cffb1e06937a321b6e8af08126d39c2b361d13210cfa394fff3f09f750a90" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.34.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.26.1.el10_2]" date="1781784000">- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}
- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.27.1.el10_2]" date="1782129600">- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
- ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.28.1.el10_2]" date="1782388800">- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}
- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1783944000">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.34.1" date="1784030400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="b2ec2ed42f60aeadca54aa304cd23f1a75d62850156ea7420c40180ad850b0a3" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.37.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.29.1.el10_2]" date="1782734400">- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}
- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]
- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]
- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}
- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.30.1.el10_2]" date="1782907200">- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.37.1" date="1784635201">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="28128a9e6ac67d51c5b1556771c473a08b4834b6293e44b435dce65bea31db76" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.39.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.31.1.el10_2]" date="1783339200">- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi-&gt;dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.39.1" date="1784894400">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="1cd5b1bdf46ea6ffbd5080384798cd1ea2dd8d4ea87b9e80005bb60e06f22518" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.40.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.32.1.el10_2]" date="1783425600">- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.33.1.el10_2]" date="1783598400">- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}</changelog>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.40.1" date="1785240000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="909a054e1d8a0601b06f74e492b2b864362fbabc8a3b94fd64831953ce2fb558" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.42.1.el10_2"/>
  <changelog author="Jan Stancek &lt;jstancek@redhat.com&gt; [6.12.0-211.34.1.el10_2]" date="1784030400">- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.42.1" date="1785499200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="d097fb5d5b824b73fce375e37dfa7675eca97d47e6e041138656fca3503af892" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.43.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.35.1.el10_2]" date="1784203200">- drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
- drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232]
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232]
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232]
- nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103]
- nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103]
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887]
- cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530}
- flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071}
- redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311]
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.43.1" date="1785844800">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="93c86d9a9fea428761fd8711cf01231dc9ace8c780c62f36ac12bc8496cb5501" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.44.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.36.1.el10_2]" date="1784548800">- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324]
- ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324]
- ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324]
- ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324]
- ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324]
- ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324]
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166}
- bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324]
- bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324]
- bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324]
- bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Add test for out-of-boundary modifications for scatter &amp; gather (Jakub Ramaseuski) [RHEL-191324]
- cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324]
- bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324]
- include: update references to include/asm-&lt;arch&gt; (Jakub Ramaseuski) [RHEL-191324]
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113}
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.37.1.el10_2]" date="1784635200">- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.44.1" date="1786104000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="5a1b37c9e78c27759b83f45b9889513df0812ba5f8f326d9fa85074b6dca90e4" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.46.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.38.1.el10_2]" date="1784721600">- net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.46.1" date="1786449600">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="5706e98aba57d794370e30bd3962fef17b6abd804f5c30d3a9a6bbedc94792d1" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.47.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.39.1.el10_2]" date="1784808000">- futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973}
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099}
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110}
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059}
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692}
- fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237}
- fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.40.1.el10_2]" date="1785153600">- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006}
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993}
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281}
- iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086}
- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254]
- rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254]
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254]
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254]
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254]
- rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635}
- rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633}
- rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632}
- rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631}
- rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254]
- rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254]
- rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254]
- rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254]
- rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.47.1" date="1786536001">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="9a182025aef45495769ec086f8ade8d8101edfa85d2bdfb81fc3d0b4e42a9756" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.49.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.41.1.el10_2]" date="1785240000">- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063]
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.49.1" date="1787227200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="8af45422eef6b0b301d7e2909560b6b0db7860afa02321bab82ea70a45984c49" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.50.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.42.1.el10_2]" date="1785326400">- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211}
- isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.50.1" date="1788264000">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="9ec4b055c7917dc58ec8f45d56a5698c8b8166cfeed17132339f49bcff8eb5b5" name="kernel-rt-modules-extra" arch="x86_64">
  <version epoch="0" ver="6.12.0" rel="211.51.1.el10_2"/>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.43.1.el10_2]" date="1785758400">- redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011]
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011]
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832]
- drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832]
- drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832]
- procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199}
- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214}
- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.44.1.el10_2]" date="1785844800">- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134]
- ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134]
- ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134]
- ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134]
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134]
- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134]
- ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134]
- ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134]
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134]
- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345]
- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345]
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345]
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.45.1.el10_2]" date="1786104000">- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.46.1.el10_2]" date="1786363200">- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.47.1.el10_2]" date="1786536000">- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887}
- perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300}
- net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264}
- KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436]
- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472]
- accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202}
- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311]
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311]
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311]
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311]
- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311]
- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311]
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311]
- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311]
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311]
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311]
- netfilter: nf_queue: hold bridge skb-&gt;dev while queued (Florian Westphal) [RHEL-185311]
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311]
- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311]
- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311]
- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311]
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311]
- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311]
- rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324}
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311]
- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311]
- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841}
- nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665}
- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681}
- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085}
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024}
- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424}
- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025}
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026}
- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311]
- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416}
- netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495}
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674}
- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: use expect-&gt;helper (Florian Westphal) [RHEL-185311]
- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311]
- netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114}
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399}
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457}
- netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407}
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458}
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451}
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453}
- netfilter: nf_tables: unconditionally bump set-&gt;nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233}
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.48.1.el10_2]" date="1786968000">- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329}
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237}
- sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545]
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954]</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.49.1.el10_2]" date="1787140800">- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
- cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459]
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459]
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459]
- cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459]
- smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459]
- smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459]
- smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459]
- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459]
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370}
- exit: kill the pointless __exit_signal()-&gt;clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850]
- exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850]
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
- smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.50.1.el10_2]" date="1788177600">- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
- nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069}
- s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180]
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391}
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086}
- userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166}
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438}
- mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417}
- mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480}
- crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277}
- mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276}
- ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018}
- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053}
- smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384}
- mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153}
- s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507]
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320}
- sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393]
- seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003}
- ip6_gre: Use cached t-&gt;net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120}
- netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454}
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450}</changelog>
  <changelog author="CKI KWF Bot &lt;cki-ci-bot+kwf-gitlab-com@redhat.com&gt; [6.12.0-211.51.1.el10_2]" date="1788264000">- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
- iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145}
- exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808}
- KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073}
- smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387}</changelog>
  <changelog author="Release Engineering &lt;releng@rockylinux.org&gt; - 6.12.0-211.51.1" date="1788523200">- Add partial riscv64 support for build root
- Provide basic VisionFive 2 support</changelog>
</package>
<package pkgid="050b1b7f29fe8515e06073e9f103c9fcda57dcc70b88fe5b18696b352235067d" name="realtime-setup" arch="x86_64">
  <version epoch="0" ver="2.5" rel="2.el10"/>
  <changelog author="Clark Williams &lt;williams@redhat.com&gt; - 2.4-1" date="1701777600">- Makefile cleanups and added .gitignore
- remove Red Hat Makefile targets and specfile
- ensure all files have valid SPDX license identifiers
- version bump</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2.4-2" date="1705924800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2.4-3" date="1706270400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 2.4-4" date="1711454400">- Add gating.yaml
- Add tests dir
Resolves: RHEL-30448</changelog>
  <changelog author="Clark Williams &lt;williams@redhat.com&gt; - 2.4.5" date="1717502400">- change gating.yaml target from rhel-9 to rhel-10
Resolves: RHEL-40030</changelog>
  <changelog author="Troy Dawson &lt;tdawson@redhat.com&gt; - 2.4-6" date="1719230400">- Bump release for June 2024 mass rebuild</changelog>
  <changelog author="Troy Dawson &lt;tdawson@redhat.com&gt; - 2.4-7" date="1730203200">- Bump release for October 2024 mass rebuild:
  Resolves: RHEL-64018</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 2.4-8" date="1733745600">- Add an rpminspect.yaml file to turn-off debuginfo testing
Resolves: RHEL-70580</changelog>
  <changelog author="Clark Williams &lt;williams@redhat.com&gt; - 2.5-1" date="1734523200">- Bump release for RHEL-10
  Resolves: RHEL-40030
- add rpminspect.yaml to turn of debuginfo check
- add compile options for passing annocheck</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 2.5-2" date="1736942400">- Bump the release number and rebuild with the correct JIRA
Resolves: RHEL-70587</changelog>
</package>
<package pkgid="ecac3b8be2de173823762c90cd03cfe171d1492db5014571e61b0b969d1bdec3" name="rteval" arch="noarch">
  <version epoch="0" ver="3.10" rel="2.el10"/>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.8.12" date="1729771200">- Add patch to put stress-ng options in their own manpage section
- Change constant name earlystop TO EARLYSTOP
- Update the kcompile kernel to linux-6.12-rc4
Resolves: RHEL-63611</changelog>
  <changelog author="Troy Dawson &lt;tdawson@redhat.com&gt; - 3.8-13" date="1730203200">- Bump release for October 2024 mass rebuild:
  Resolves: RHEL-64018</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-1" date="1731672000">- Rebase to upstream rteval-3.9
Resolves: RHEL-65483</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-2" date="1734091200">- Fix missing system statistics
Resolves: RHEL-70167</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-3" date="1738929600">- Make the default interval for timerlat in rteval 1100us
- Make cyclictest the default measurement module for rteval
Resolves: RHEL-78395</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-4" date="1750248000">- rteval: services.py: Fix SyntaxWarning
Resolves: RHEL-92783</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-5" date="1750334400">- Make timerlat the default measurement module
- Make the default interval 100us
Resolves: RHEL-97541</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.9-6" date="1761912000">- Convert spec file to use pyproject.toml build system
- Add 8 patches from upstream (spelling fixes, typo corrections, cleanups)
- Modernize packaging with %pyproject_wheel and %pyproject_install macros
Resolves: RHEL-114900</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.10-1" date="1763121600">- Update to rteval-3.10
- set rtla timerlat dma latency to 0 to be more consistent with cyclictest
- Create a commandline switch for rteval to use cyclictest
- Update rteval-loads requirement to &gt;= 6.17.7-1
Resolves: RHEL-82915, RHEL-116596, RHEL-114927</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 3.10-2" date="1764158400">- Remove rteval -s as a gating test
Resolves: RHEL-131402</changelog>
</package>
<package pkgid="d15961a49e0945d2e9703892270f8abe287ea67f8d1d0be71173b10a1efccb46" name="rteval-loads" arch="noarch">
  <version epoch="0" ver="6.17.7" rel="3.el10"/>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 1.6-8" date="1711454400">- Add gating.yaml
- Add tests
Resolves: RHEL-30432</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 1.6-9" date="1718625600">- Change the gating.yaml from rhel-9 to rhel-10
Resolves: RHEL-42982</changelog>
  <changelog author="Troy Dawson &lt;tdawson@redhat.com&gt; - 1.6-10" date="1719230400">- Bump release for June 2024 mass rebuild</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 1.6-11" date="1723204800">- Remove code using deprectated engine.h until a better solution available
Resolves: RHEL-47107</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 1.6-12" date="1724068800">- Create a kernel based off of linux-6.10.5 and three upstream patches
  to remove a dependency on deprecated &lt;openssl/engine.h&gt;
Resolves: RHEL-47107</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 1.6-13" date="1729857600">- Update to linux-6.12-rc4 which contains the patches
  to remove dependency on deprecated &lt;openssl/engine.h&gt;
Resolves: RHEL-63613</changelog>
  <changelog author="Troy Dawson &lt;tdawson@redhat.com&gt; - 1.6-14" date="1730203200">- Bump release for October 2024 mass rebuild:
  Resolves: RHEL-64018</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 6.17.7-1" date="1763121600">- Changed the kernel version to 6.17.7
- changed the rteval-loads number scheme to reflect the kernel version
Resolves: RHEL-86702</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 6.17.7-2" date="1763467200">- Rebuild in a side-tag to sync with rteval
Resolves: RHEL-86702</changelog>
  <changelog author="John Kacur &lt;jkacur@redhat.com&gt; - 6.17.7-3" date="1764158400">- Fix run_tests.sh to test linux-6.17.7.tar.xz is installed as a compile load
Resolves: RHEL-131349</changelog>
</package>
<package pkgid="537bf957323c3e7a46cba8f0b48ea3cb54c163c6d2b5be2efed5a347113b88f2" name="tuned-profiles-nfv" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="1.el10"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-3" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66636
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66613</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
    resolves: RHEL-74384
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
    resolves: RHEL-69933
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - sap-hana: Set transparent_hugepages to madvise
    resolves: RHEL-68454
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-94185</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94809
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
    resolves: RHEL-94842
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
    resolves: RHEL-88238
  - functions: silenced errors if module kvm_intel does not exist
  - functions: make calc_isolated_cores return CPU ranges
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
    resolves: RHEL-79913
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: disable appropriate P-State drivers
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
    resolves: RHEL-97087
  - udev-settle: obey udev buffer size and handle possible tracebacks
    resolves: RHEL-92637
  - daemon: re-raise daemon init exception in no-daemon mode
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94809</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1.1" date="1760961600">- cpu-partitioning: added initrd generation dracut/systemd workarounds
  resolves: RHEL-120175</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123608
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    resolves: RHEL-40619
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
    resolves: RHEL-142285
  - man: fixed instance_acquire_devices example in tuned-adm man
    resolves: RHEL-90575
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123608</changelog>
</package>
<package pkgid="7705446a1a210f7fc0b5c089d97f8b1facf25f82dd6b4280d28e2d7dc2cb9da8" name="tuned-profiles-nfv" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="2.el10_2"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
    resolves: RHEL-74384
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
    resolves: RHEL-69933
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - sap-hana: Set transparent_hugepages to madvise
    resolves: RHEL-68454
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-94185</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94809
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
    resolves: RHEL-94842
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
    resolves: RHEL-88238
  - functions: silenced errors if module kvm_intel does not exist
  - functions: make calc_isolated_cores return CPU ranges
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
    resolves: RHEL-79913
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: disable appropriate P-State drivers
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
    resolves: RHEL-97087
  - udev-settle: obey udev buffer size and handle possible tracebacks
    resolves: RHEL-92637
  - daemon: re-raise daemon init exception in no-daemon mode
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94809</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1.1" date="1760961600">- cpu-partitioning: added initrd generation dracut/systemd workarounds
  resolves: RHEL-120175</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123608
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    resolves: RHEL-40619
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
    resolves: RHEL-142285
  - man: fixed instance_acquire_devices example in tuned-adm man
    resolves: RHEL-90575
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123608</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2" date="1781524800">- net: added more coalescing options, filter out unsupported ones
  resolves: RHEL-181667</changelog>
</package>
<package pkgid="bbcd74e1b295005154d5a149f9f91db147961f832e5b6a3f460eda956319a0d0" name="tuned-profiles-nfv-guest" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="1.el10"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-3" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66636
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66613</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
    resolves: RHEL-74384
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
    resolves: RHEL-69933
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - sap-hana: Set transparent_hugepages to madvise
    resolves: RHEL-68454
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-94185</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94809
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
    resolves: RHEL-94842
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
    resolves: RHEL-88238
  - functions: silenced errors if module kvm_intel does not exist
  - functions: make calc_isolated_cores return CPU ranges
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
    resolves: RHEL-79913
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: disable appropriate P-State drivers
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
    resolves: RHEL-97087
  - udev-settle: obey udev buffer size and handle possible tracebacks
    resolves: RHEL-92637
  - daemon: re-raise daemon init exception in no-daemon mode
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94809</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1.1" date="1760961600">- cpu-partitioning: added initrd generation dracut/systemd workarounds
  resolves: RHEL-120175</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123608
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    resolves: RHEL-40619
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
    resolves: RHEL-142285
  - man: fixed instance_acquire_devices example in tuned-adm man
    resolves: RHEL-90575
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123608</changelog>
</package>
<package pkgid="4f29bd3b6a6cff0002b676ddc576f2b682f68c26d7506e883404f376727db68b" name="tuned-profiles-nfv-guest" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="2.el10_2"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
    resolves: RHEL-74384
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
    resolves: RHEL-69933
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - sap-hana: Set transparent_hugepages to madvise
    resolves: RHEL-68454
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-94185</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94809
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
    resolves: RHEL-94842
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
    resolves: RHEL-88238
  - functions: silenced errors if module kvm_intel does not exist
  - functions: make calc_isolated_cores return CPU ranges
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
    resolves: RHEL-79913
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: disable appropriate P-State drivers
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
    resolves: RHEL-97087
  - udev-settle: obey udev buffer size and handle possible tracebacks
    resolves: RHEL-92637
  - daemon: re-raise daemon init exception in no-daemon mode
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94809</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1.1" date="1760961600">- cpu-partitioning: added initrd generation dracut/systemd workarounds
  resolves: RHEL-120175</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123608
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    resolves: RHEL-40619
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
    resolves: RHEL-142285
  - man: fixed instance_acquire_devices example in tuned-adm man
    resolves: RHEL-90575
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123608</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2" date="1781524800">- net: added more coalescing options, filter out unsupported ones
  resolves: RHEL-181667</changelog>
</package>
<package pkgid="a7ace69b6e2bcf4bb1a4036fde5d71902d5698bb6a4b29a91216fd1a82f52c5b" name="tuned-profiles-nfv-host" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="1.el10"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-3" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66636
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66613</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
    resolves: RHEL-74384
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
    resolves: RHEL-69933
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - sap-hana: Set transparent_hugepages to madvise
    resolves: RHEL-68454
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-94185</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94809
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
    resolves: RHEL-94842
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
    resolves: RHEL-88238
  - functions: silenced errors if module kvm_intel does not exist
  - functions: make calc_isolated_cores return CPU ranges
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
    resolves: RHEL-79913
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: disable appropriate P-State drivers
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
    resolves: RHEL-97087
  - udev-settle: obey udev buffer size and handle possible tracebacks
    resolves: RHEL-92637
  - daemon: re-raise daemon init exception in no-daemon mode
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94809</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1.1" date="1760961600">- cpu-partitioning: added initrd generation dracut/systemd workarounds
  resolves: RHEL-120175</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123608
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    resolves: RHEL-40619
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
    resolves: RHEL-142285
  - man: fixed instance_acquire_devices example in tuned-adm man
    resolves: RHEL-90575
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123608</changelog>
</package>
<package pkgid="00e2c080a7e28876bbf1cae31069dff31e291d71561183b0c400f6b3a66416eb" name="tuned-profiles-nfv-host" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="2.el10_2"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
    resolves: RHEL-74384
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
    resolves: RHEL-69933
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - sap-hana: Set transparent_hugepages to madvise
    resolves: RHEL-68454
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-94185</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94809
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
    resolves: RHEL-94842
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
    resolves: RHEL-88238
  - functions: silenced errors if module kvm_intel does not exist
  - functions: make calc_isolated_cores return CPU ranges
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
    resolves: RHEL-79913
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: disable appropriate P-State drivers
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
    resolves: RHEL-97087
  - udev-settle: obey udev buffer size and handle possible tracebacks
    resolves: RHEL-92637
  - daemon: re-raise daemon init exception in no-daemon mode
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94809</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1.1" date="1760961600">- cpu-partitioning: added initrd generation dracut/systemd workarounds
  resolves: RHEL-120175</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123608
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    resolves: RHEL-40619
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
    resolves: RHEL-142285
  - man: fixed instance_acquire_devices example in tuned-adm man
    resolves: RHEL-90575
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123608</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2" date="1781524800">- net: added more coalescing options, filter out unsupported ones
  resolves: RHEL-181667</changelog>
</package>
<package pkgid="c0fb6128c8a004ca782876cd408347c140d5815362ebd081364a9464b3bc5e07" name="tuned-profiles-realtime" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="1.el10"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.24.0-3" date="1731931200">- Fixed privileged execution of arbitrary scripts by active local user,
  (CVE-2024-52336)
  Resolves: RHEL-66636
- Added sanity checks for API methods parameters, (CVE-2024-52337)
  Resolves: RHEL-66613</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
    resolves: RHEL-74384
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
    resolves: RHEL-69933
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - sap-hana: Set transparent_hugepages to madvise
    resolves: RHEL-68454
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-94185</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94809
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
    resolves: RHEL-94842
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
    resolves: RHEL-88238
  - functions: silenced errors if module kvm_intel does not exist
  - functions: make calc_isolated_cores return CPU ranges
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
    resolves: RHEL-79913
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: disable appropriate P-State drivers
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
    resolves: RHEL-97087
  - udev-settle: obey udev buffer size and handle possible tracebacks
    resolves: RHEL-92637
  - daemon: re-raise daemon init exception in no-daemon mode
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94809</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1.1" date="1760961600">- cpu-partitioning: added initrd generation dracut/systemd workarounds
  resolves: RHEL-120175</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123608
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    resolves: RHEL-40619
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
    resolves: RHEL-142285
  - man: fixed instance_acquire_devices example in tuned-adm man
    resolves: RHEL-90575
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123608</changelog>
</package>
<package pkgid="ad1a852f12fb736d20e3884d0692cbb8c89c660a5edaff226c48c13517109d85" name="tuned-profiles-realtime" arch="noarch">
  <version epoch="0" ver="2.27.0" rel="2.el10_2"/>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-0.1.rc1" date="1737288000">- new release
  - tuned-ppd: removed the use of StrEnum
  - tuned-ppd: fixed traceback
    resolves: RHEL-74384
  - tuned-ppd: multiple fixes and updates
  - docs: plugins docs are now automatically generated from the docstrings
  - plugin_cpu: fixed no_turbo boolean option parsing
  - plugin_cpu: allowed raw energy_performance_preference values
  - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
  - plugin_bootloader: added variables to BLS entries only if grub is used
  - plugin_scheduler: do not assume that perf events have type attribute
  - plugin_scheduler: updated sched knobs for kernels 6.6+
  - plugin_scheduler: log process info when its affinity cannot be changed
    resolves: RHEL-69933
  - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
  - plugin_scheduler: made perf support optional
  - plugin_net: added support for hotplug and rename
  - makefile: added support for installation to custom $BINDIR/$SBINDIR
  - functions: dropped cpuspeed support</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.0-1" date="1738324800">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - sap-hana: Set transparent_hugepages to madvise
    resolves: RHEL-68454
  - plugin_bootloader: export Grub variables to make them available in submenus
  - utils.commands: fixed CPU online detection when not present
  - plugin_net: handled cqe-mode-rx ethtool option
  - profiles: correct CPU governor settings</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.25.1-1" date="1738670400">- new release
  - rebased tuned to latest upstream
    related: RHEL-70454
  - plugins: added missing instance parameters
  - disk: added missing remove parameter
  - plugin_scheduler: added switch to disable processing of kthreads
  - Makefile: added support for installation to custom LIBEXECDIR
  - functions: create a new parser object for each string expansion</changelog>
  <changelog author="Pavol &#x17D;&#xE1;&#x10D;ik &lt;pzacik@redhat.com&gt; - 2.25.1-2" date="1749124800">- Fix handling of kernel arguments on bootc systems
  resolves: RHEL-94185</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-0.1.rc1" date="1755432000">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-94809
  - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
  - tuned-ppd: enabled sysfs_acpi_monitor by default
  - tuned-ppd: fixed inotify watch for performance degradation
  - tuned-ppd: pinned virtual files in memory for inotify
  - fixed instance priority inheritance
    resolves: RHEL-94842
  - hotplug: added fixes for device remove race condition
  - tuned-main.conf: added startup_udev_settle_wait option
    resolves: RHEL-88238
  - functions: silenced errors if module kvm_intel does not exist
  - functions: make calc_isolated_cores return CPU ranges
  - scsi: used 'med_power_with_dipm' for SATA ALPM
  - scsi: do not set ALPM on external SATA ports
    resolves: RHEL-79913
  - network_latency: Set non-zero rcutree.nohz_full_patience_delay
  - realtime: disable appropriate P-State drivers
  - plugin_disk: added support for MMC (MultiMediaCard) devices
  - udev: fix possible traceback in device matcher
    resolves: RHEL-97087
  - udev-settle: obey udev buffer size and handle possible tracebacks
    resolves: RHEL-92637
  - daemon: re-raise daemon init exception in no-daemon mode
  - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
  - gui: fix the profile deleter script</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1" date="1756123200">- new release
  - rebased tuned to latest upstream
    related: RHEL-94809</changelog>
  <changelog author="Jaroslav &#x160;karvada  &lt;jskarvad@redhat.com&gt; - 2.26.0-1.1" date="1760961600">- cpu-partitioning: added initrd generation dracut/systemd workarounds
  resolves: RHEL-120175</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-0.1.rc1" date="1770724800">- new release
  - rebased tuned to latest upstream
    resolves: RHEL-123608
  - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    resolves: RHEL-40619
  - openshift: optimize TCP settings for high throughput and low latency
  - profiles: Set boost=1 in *-performance profiles
  - sap-hana: force latency to 70 us, not to C-states
    resolves: RHEL-142285
  - man: fixed instance_acquire_devices example in tuned-adm man
    resolves: RHEL-90575
  - spec: use correct python interpreter for documentation installation
  - sysctl: add reapply_sysctl_exclude option
  - ppd: ask tuned recommend for base profile</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-1" date="1771761600">- new release
  - rebased tuned to latest upstream
    related: RHEL-123608</changelog>
  <changelog author="Jaroslav &#x160;karvada &lt;jskarvad@redhat.com&gt; - 2.27.0-2" date="1781524800">- net: added more coalescing options, filter out unsupported ones
  resolves: RHEL-181667</changelog>
</package>
</otherdata>