mirror of
https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
synced 2026-09-09 00:08:12 +08:00
main
100
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 CKI KWF Bot
|
c234fccc30 |
[redhat] kernel-5.14.0-742.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
0e177bc37f |
Merge: Merge tag 'kernel-5.14.0-741.2.1.el9_9' into centos-stream-9/main
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8711 Merge kernel MRs from RHEL-9.9's kernel-5.14.0-741.2.1.el9_9 into the centos-stream-9/main repo for 9.10 inclusion. MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8414 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8400 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8660 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8658 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8591 MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-9/-/merge_requests/7144 Signed-off-by: Jarod Wilson <jarod@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e689632e86 |
Merge: Merge tag 'kernel-5.14.0-741.1.1.el9_9' into centos-stream-9/main
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8708 Merge kernel MRs from RHEL-9.9's kernel-5.14.0-741.1.1.el9_9 into the centos-stream-9/main repo for 9.10 inclusion. MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8664 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8234 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8535 MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-9/-/merge_requests/7141 MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-9/-/merge_requests/7139 Signed-off-by: Jarod Wilson <jarod@redhat.com> Approved-by: Shivani Chandanshive <schandan@redhat.com> Approved-by: Julio Faracco <jfaracco@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
ff7f57bac8 |
Merge: redhat: update RHEL_MINOR version for start of RHEL-9.10 development
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8701 JIRA: INTERNAL Upstream Status: RHEL-9-only This bumps the value of RHEL_MINOR to 10 so we can formally get RHEL-9.10 merge requests merged and start doing development builds. Signed-off-by: Julio Faracco <jfaracco@redhat.com> Approved-by: Jan Stancek <jstancek@redhat.com> Approved-by: Oleksii Baranov <olebaran@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
2adffda844 |
Merge: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8697 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks JIRA: https://redhat.atlassian.net/browse/RHEL-248152 commit 337bd95507a16063687cfc286ea90de5cca48c37 Author: Thomas Richter tmricht@linux.ibm.com Date: Tue Aug 11 15:39:01 2026 +0200 ``` s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- <command>' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu_cf_events at first event initialization. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online create an event for CPUs 0,2-X. Since the events are created with task-context, the scheduler will eventually schedule the program on CPU1. This CPU has not created and initialized any per CPU event infrastructure as that CPU was not online at the time of the perf invocation. Thus when the scheduler runs stress-ng on CPU1, the function cpumf_pmu_add() refers to a NULL pointer: struct cpu_cf_events *cpuhw = this_cpu_cfhw(); This function call is invoked after the task stress-ng has been made runnable on CPU1. And this_cpu_cfhw() returns NULL. The result is a panic: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 0000000000000483 .... Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80) .... Call Trace: [<000003ef8291fd0c>] cpumf_pmu_add+0x3c/0x80 [<000003ef82bb5e3e>] event_sched_in+0xae/0x190 [<000003ef82bb60d6>] merge_sched_in+0x1b6/0x390 [<000003ef82bb65b8>] visit_groups_merge.constprop.0.isra.0+0x308/0x5b0 [<000003ef82bb689a>] pmu_groups_sched_in+0x3a/0x50 [<000003ef82bb6a30>] ctx_sched_in+0x180/0x260 [<000003ef82bb780c>] perf_event_context_sched_in+0x11c/0x2d0 [<000003ef82bb79ee>] __perf_event_task_sched_in+0x2e/0xc0 [<000003ef82994834>] finish_task_switch.isra.0+0x1a4/0x250 .... Last Breaking-Event-Address: [<000003ef8291f1d8>] this_cpu_cfhw+0x38/0x40 The issue arises only in per-task context when the CPUMF facility is used and the scheduler picks a random CPU for such a process to run on. The scheduler enables the CPUMF infrastructure via PMU callback functions pmu::add() and pmu::del(). Introduce a CPU hotplug prepare/dead callback pair which creates and removes the per CPU counter data while the CPU is offline. Count the users which track every CPU (cpu == -1), that is perf_event_open() events with task context and /dev/hwctr device sessions, in the new counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex. This ensures the infrastructure is available when new CPU is selected to run the per-task context process. In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference pointer to data structures is set to NULL before the data is freed to prevent interrupt handlers to access stale data. [gor@linux.ibm.com: change commit message] Fixes: 9b9cf3c77e7e ("s390/cpum_cf: rework PER_CPU_DEFINE of struct cpu_cf_events") Cc: stable@vger.kernel.org # v6.5+ Suggested-by: Heiko Carstens <hca@linux.ibm.com> Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Thomas Richter <tmricht@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> ``` Signed-off-by: Jan Polensky <jpolensk@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
3a09f7251f |
Merge: [RHEL 9.10] Update drivers/platform/x86/intel to upstream v7.2
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8694 JIRA: https://redhat.atlassian.net/browse/RHEL-241103 Standard recurring update of drivers/platform/x86/intel Three commits applied in 9.9 were reverted to be applied again in this MR in original order. With the exception of commit |
||
|
CKI KWF Bot
|
dda94f8ff7 |
Merge: [RHEL 9.10]: select amd-pstate fixes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8467 JIRA: https://redhat.atlassian.net/browse/RHEL-212670 RHEL is missing the following upstream commits: beda3b363546 amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() fcc25a291fbd amd-pstate: Update cppc_req_cached in fast_switch case c03791085adc cpufreq: Pass the policy to cpufreq_driver->adjust_perf() 3cd07ee35a66 cpufreq/amd-pstate: drop stale @epp_cached kdoc Signed-off-by: Dennis Chen <dechen@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Desnes Nunes <desnesn@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5ee740f3c6 |
Merge: mmc: sdhci-of-dwcmshc: Add hw_reset() support for BlueField-3 SoC
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8352 JIRA: https://redhat.atlassian.net/browse/RHEL-104072 sdhci-of-dwcmshc: driver update to Linux v6.16 \[Nvidia 9.9 FEAT\] Signed-off-by: David Thompson <davithom@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
83975728a9 |
[redhat] kernel-5.14.0-741.2.1.el9_9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
1278efb287 |
Merge: net: ipv6: clear suppressed fib6 rule result
MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-9/-/merge_requests/7144 JIRA: https://issues.redhat.com/browse/RHEL-246350 CVE: CVE-2026-74581 A fix for a critical ipv6 issue. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Approved-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Approved-by: Guillaume Nault <gnault@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
0974d7f613 |
Merge: CVE-2026-63824 kernel: KEYS: fix overflow in keyctl_pkey_params_get_2()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8591 JIRA: https://redhat.atlassian.net/browse/RHEL-229620 CVE: CVE-2026-63824 The length for the internal output buffer is calculated incorrectl in keyctl_pkey_params_get_2(), but to fix it we also bring another commit to prepare the tree and allow a clean backport of the CVE fix. Signed-off-by: Bruno Meneguele <bmeneg@redhat.com> Approved-by: Thomas Huth <thuth@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
838155400a |
Merge: NFS/NFSD CVE fixes for RHEL 9.9
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8658 Fixes for various NFS/NFSD CVEs: - nfsd: release layout stid on setlease failure - NFSv4/flexfiles: reject zero filehandle version count - nfsd: fix posix_acl leak on SETACL decode failure - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - pNFS: Fix use-after-free in pnfs_update_layout() JIRA: https://issues.redhat.com/browse/RHEL-225523 JIRA: https://redhat.atlassian.net/browse/RHEL-226326 JIRA: https://redhat.atlassian.net/browse/RHEL-227787 JIRA: https://redhat.atlassian.net/browse/RHEL-228034 JIRA: https://redhat.atlassian.net/browse/RHEL-229413 JIRA: https://redhat.atlassian.net/browse/RHEL-234058 CVE: CVE-2026-53391 CVE: CVE-2026-53392 CVE: CVE-2026-53397 CVE: CVE-2026-53399 CVE: CVE-2026-63800 CVE: CVE-2026-64298 Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> Signed-off-by: Scott Mayhew <smayhew@redhat.com> Approved-by: Roberto Bergantinos Corpas <rbergant@redhat.com> Approved-by: Olga Kornievskaia <okorniev@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
6b947a98e4 |
Merge: CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8660 JIRA: https://redhat.atlassian.net/browse/RHEL-240184 CVE: CVE-2026-68145 * 93aa6fe6768327e83bd122f663c9cdda968119af iomap: hold state_lock over call to ifs_set_range_uptodate() [linux] * e538eecaa39ef2c7203e1f7ac94726da1c25e187 iomap: fix out-of-bounds bitmap_set() with zero-length range [linux] Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> Assisted-by: Patchpal Please scrutinize this automated backport with additional caution and skepticism, as this was not a simple clean cherry-pick backport case. Algorithms were used to aid in applying the requested commit(s). The following commits were added to the backport as prerequisites to requested commits to get them to apply: - 279d5fc3227f04ef2c6125e5c440e7952173a89a "iomap: hold state_lock over call to ifs_set_range_uptodate()" [^footer]: Created 2026-08-13 15:28 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Brian Foster <bfoster@redhat.com> Approved-by: Carlos Maiolino <cmaiolino@redhat.com> Approved-by: Pavel Reichl <preichl@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f178149437 |
Merge: CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8400
JIRA: https://redhat.atlassian.net/browse/RHEL-213196
CVE: CVE-2026-63887
Backported from tree(s): linux
```
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
iscsi_encode_text_output() concatenates "key=value\0" records into
login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer
allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call
sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check
the remaining buffer capacity:
*length += sprintf(output_buf, "%s=%s", er->key, er->value);
*length += 1;
output_buf = textbuf + *length;
The 8192-byte ceiling at iscsi_target_check_login_request() bounds the
*input* Login PDU payload, but a single PDU can carry up to 2048 minimal
four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte
"a=NotUnderstood\0" output record via iscsi_add_notunderstood_response().
2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB
heap overrun in the kmalloc-8k slab.
The fix introduces a static iscsi_encode_text_record() helper that uses
snprintf() with a per-call bounds check against the remaining buffer,
and threads a u32 textbuf_size parameter through
iscsi_encode_text_output(). Both call sites in
iscsi_target_handle_csg_zero() (PHASE_SECURITY) and
iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass
MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls
iscsi_release_extra_responses() to drop queued records, and returns -1;
both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR /
ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning,
so the initiator sees an explicit failed-login response rather than a
silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL
caller did that; the PHASE_SECURITY caller is converted to the same
shape.)
Fixes:
|
||
|
CKI KWF Bot
|
6c2cce9657 |
Merge: KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8414 # Merge Request Required Information ## Summary of Changes Red Hat is seeing multiple reports of Windows memory corruptions (and consequent BSODs) with hv-tlbflush=on, on AMD processors only. The crashes, while extremely rare, happen even with a stock configuration, but with Driver Verifier enabled they can be detected after approximately 200 VM hours. So, for lack of better ideas, this patch forces a full ASID bump in svm_flush_tlb_gva(). To avoid paying the price on Intel and also to avoid unnecessary loops on AMD, the flush_tlb_gva op now returns whether it did a full flush or not; kvm_hv_vcpu_flush_tlb() takes note and exits its loops immediately. While there is an obvious performance impact, about half of the benefit from Hyper-V tlbflush is preserved (10% vs. 20% on the SQL Server workload). ## Approved Development Ticket(s) All submissions to CentOS Stream must reference a ticket in [Red Hat Jira](https://issues.redhat.com/). ``` JIRA: https://redhat.atlassian.net/browse/RHEL-214433 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> ``` Approved-by: Vitaly Kuznetsov <vkuznets@redhat.com> Approved-by: awallace9 <awallace@redhat.com> Approved-by: Maxim Levitsky <mlevitsk@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
7d4b87cdeb |
[redhat] kernel-5.14.0-741.1.1.el9_9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
62cba385d9 |
Merge: xen/privcmd: fix double free via VMA splitting
MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-9/-/merge_requests/7139 JIRA: https://redhat.atlassian.net/browse/RHEL-172489 CVE: CVE-2026-31787 fix double free via VMA splitting in Xen privcmd. Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Approved-by: Evgenii Kolesnikov <ekolesni@redhat.com> Approved-by: Thilak KN <tkn@redhat.com> Approved-by: Ani Sinha <anisinha@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5f3e011218 |
Merge: Buffer overflow in drivers/xen/sys-hypervisor.c
MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-9/-/merge_requests/7141 JIRA: https://redhat.atlassian.net/browse/RHEL-172511 CVE: CVE-2026-31786 Fix buffer overflow in drivers/xen/sys-hypervisor.c. Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Approved-by: Evgenii Kolesnikov <ekolesni@redhat.com> Approved-by: Thilak KN <tkn@redhat.com> Approved-by: Ani Sinha <anisinha@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
1de24ebbc8 |
Merge: CVE-2026-64490: ALSA: virtio: Validate control metadata from the device
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8535 JIRA: https://redhat.atlassian.net/browse/RHEL-230137 CVE: CVE-2026-64490 Backported from tree(s): linux ``` ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA. Fixes: d6568e3de42d ("ALSA: virtio: add support for audio controls") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260507-alsa-virtio-validate-kctl-info-v1-1-7404fb12ec37@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> (cherry picked from commit c77a6cbb36ff8cbc1f084d94f8dcda5250935271) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-08-05 23:53 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Jaroslav Kysela <jkysela@redhat.com> Approved-by: Daniel Horak <dhorak@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f6aa9f3674 |
Merge: net: ipv6: P2 backports for 9.9
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8234
A set of various fixes and improvements in the IPv6 area for 9.9; backported as part of our P2 backports.
Some RHEL-only changes in patches 17-18, please check accordingly.
JIRA: https://redhat.atlassian.net/browse/RHEL-152681
Ignore-duplicate:
|
||
|
CKI KWF Bot
|
aa427a3f57 |
Merge: Batch: y-stream SCTP and TIPC - rhel-9.9
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8664 JIRA: https://redhat.atlassian.net/browse/RHEL-228882 JIRA: https://redhat.atlassian.net/browse/RHEL-238040 JIRA: https://redhat.atlassian.net/browse/RHEL-229476 JIRA: https://redhat.atlassian.net/browse/RHEL-231576 JIRA: https://redhat.atlassian.net/browse/RHEL-236160 JIRA: https://redhat.atlassian.net/browse/RHEL-237403 JIRA: https://redhat.atlassian.net/browse/RHEL-237090 CVE: CVE-2026-63801 CVE: CVE-2026-68117 CVE: CVE-2026-63971 CVE: CVE-2026-52917 CVE: CVE-2026-68315 CVE: CVE-2026-68376 CVE: CVE-2026-68300 Patch 1-5 are backporting SCTP CVEs and 6-7 are backporting TIPC CVEs. Signed-off-by: Xin Long <lxin@redhat.com> Approved-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
4bf62708c7 |
Merge: redhat: set defaults for 9.9 stabilization/zstream
MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-9/-/merge_requests/7158 JIRA: INTERNAL Upstream status: RHEL-9 only - set DIST to el9_9 - set ZSTREAM to yes - set gitlab-ci vars - update self-test data Signed-off-by: Jarod Wilson <jarod@redhat.com> Approved-by: Shivani Chandanshive <schandan@redhat.com> Approved-by: Jan Stancek <jstancek@redhat.com> Approved-by: Tales da Aparecida <tales.aparecida@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Approved-by: Oleksii Baranov <olebaran@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
cedf2797e3 |
[redhat] kernel-5.14.0-741.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
1e60cab914 |
Merge: dm cache policy smq: check allocation under invalidate lock
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8665 JIRA: https://issues.redhat.com/browse/RHEL-231826 CVE: CVE-2026-53062 Tested: Reproducer and dm cache tests Upstream Status: kernel/git/torvalds/linux.git commit d3f0a606b9f278ece8a0df626ded9c4044071235 Author: Guangshuo Li <lgs201920130244@gmail.com> Date: Fri May 29 23:57:45 2026 +0800 dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") added mq->lock around the destructive part of smq_invalidate_mapping(), but left the e->allocated check outside the critical section. That leaves a check-then-act race. Two concurrent invalidators can both observe e->allocated as true before either of them takes mq->lock. The first invalidator that acquires the lock removes the entry from the queues and hash table and then calls free_entry(), which clears e->allocated and puts the entry back on the free list. The second invalidator can then acquire mq->lock and continue with the stale result of the unlocked check. This can corrupt the SMQ queues or hash table by deleting an entry that is no longer on those structures. It can also hit the allocation check in free_entry() when the same entry is freed again. Move the allocation check under mq->lock so the predicate and the destructive operations are serialized by the same lock. Fixes: 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> Approved-by: Matthew Sakai <msakai@redhat.com> Approved-by: Ming Hung Tsai <mtsai@redhat.com> Approved-by: Kenneth Raeburn <raeburn@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
77af58432d |
Merge: sctp: validate cached peer INIT chunk in cookie
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8595 JIRA: https://redhat.atlassian.net/browse/RHEL-190190 CVE: CVE-2026-53246 Patch 1 is CVE fix, and patch 2 is a similar fix for cookie. Signed-off-by: Xin Long <lxin@redhat.com> Approved-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
4355d48190 |
Merge: CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8577
JIRA: https://redhat.atlassian.net/browse/RHEL-234286
CVE: CVE-2026-64564
Backported from tree(s): linux
```
sctp: don't free the ASCONF's own transport in DEL-IP processing
sctp_process_asconf() caches the transport the ASCONF chunk is processed
against in asconf->transport (== chunk->transport, set once in sctp_rcv()).
For an ASCONF located through its Address Parameter by
__sctp_rcv_asconf_lookup(), that cached transport corresponds to the
Address Parameter, which need not be the packet's source address.
sctp_process_asconf_param() rejects a DEL-IP for the packet source address
(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.
A single ASCONF can therefore carry, in order:
[Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]
where L differs from the source. The DEL-IP for L passes the D8 check and
calls sctp_assoc_rm_peer() on the transport that asconf->transport still
points at, freeing it (RCU-deferred). The following wildcard DEL-IP then
reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and
sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed
transport (->ipaddr, ->state) and plants the dangling pointer into
asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping
only the pointer that is no longer on the list, removes every real
transport, leaving the association with a transport_count of 0 and
primary_path/active_path pointing at freed memory.
Reject a DEL-IP that targets the transport the ASCONF is being processed
against, mirroring the existing source-address guard, so the wildcard
branch can never reuse a freed transport.
Fixes:
|
||
|
CKI KWF Bot
|
b38e3d3909 |
Merge: CVE-2026-64277: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8551
JIRA: https://redhat.atlassian.net/browse/RHEL-231453
CVE: CVE-2026-64277
Backported from tree(s): linux
```
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
rmi_f3a_initialize() takes the GPIO count from the device query register
(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).
rmi_f3a_map_gpios() then allocates gpio_key_map with
min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f3a_attention() iterates the full gpio_count and dereferences
gpio_key_map[i], and input->keycodemax is set to the full gpio_count
while input->keycode points at the 6-entry allocation.
A device that reports gpio_count > 6 therefore causes an out-of-bounds
read of gpio_key_map[] on every attention interrupt, and out-of-bounds
accesses through the input core's default keymap ioctls: EVIOCGKEYCODE
reads past the buffer (leaking adjacent slab memory to user space) and
EVIOCSKEYCODE writes a caller-controlled value past it, for any process
able to open the evdev node, since input_default_getkeycode() and
input_default_setkeycode() only bound the index against keycodemax.
Size the keymap for the full gpio_count. The mapping loop is unchanged:
it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)
entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)
and are skipped when reporting.
Fixes:
|
||
|
CKI KWF Bot
|
3bfe70209c |
Merge: CVE-2026-64276: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8534
JIRA: https://redhat.atlassian.net/browse/RHEL-230265
CVE: CVE-2026-64276
Backported from tree(s): linux
```
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
rmi_f30_map_gpios() allocates gpioled_key_map with
min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f30_attention() iterates the full f30->gpioled_count (device query
register, range 0..31) and dereferences gpioled_key_map[i], and
input->keycodemax is set to the full gpioled_count while input->keycode
points at the 6-entry allocation.
A device that reports gpioled_count > 6 with GPIO support enabled
therefore causes an out-of-bounds read on the attention interrupt and
out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,
which bound the index only against keycodemax. This is the same defect
as the F3A handler, which was copied from F30.
Size the keymap for the full gpioled_count; the mapping loop still
assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.
Fixes:
|
||
|
CKI KWF Bot
|
9f5db116c9 |
Merge: sctp: prevent peer transport count overflow [9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8426
JIRA: https://redhat.atlassian.net/browse/RHEL-214461
Backported from tree(s): net
```
sctp: prevent peer transport count overflow
sctp_assoc_add_peer() increments the association's 16-bit transport_count
for every new unique peer. Adding the 65,536th transport wraps the count to
zero.
SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,
then copies one sockaddr_storage for every entry in transport_addr_list.
After the wrap, a diagnostic dump reserves an empty payload and writes
8 MiB of peer addresses past the skb tail.
Reject a new unique peer when transport_count has reached U16_MAX. Perform
the check after the existing-peer lookup so a duplicate address continues
to return its existing transport at the limit.
Fixes:
|
||
|
CKI KWF Bot
|
88c2540415 |
Merge: sctp: hold socket lock when dumping endpoints in sctp_diag
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8384 JIRA: https://redhat.atlassian.net/browse/RHEL-212388 Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8060 7d8297e26b4e ("sctp: hold socket lock when dumping endpoints in sctp_diag") Signed-off-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Xin Long <lxin@redhat.com> Approved-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f401f210c3 |
Merge: CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8270
JIRA: https://redhat.atlassian.net/browse/RHEL-188202
CVE: CVE-2026-52924
Backported from tree(s): linux
```
sctp: purge outqueue on stale COOKIE-ECHO handling
sctp_stream_update() is only invoked when the association is moved into
COOKIE_WAIT during association setup/reconfiguration. In this path, the
outbound stream scheduler state (stream->out_curr) is expected to be
clean, since no user data should have been transmitted yet unless the
state machine has already partially progressed.
However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a
Stale Cookie ERROR is received, the association is rolled back from
COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already
have been queued and even bundled with the COOKIE-ECHO chunk.
During the rollback, sctp_stream_update() frees the old stream table
and installs a new one, but it does not invalidate stream->out_curr.
As a result, out_curr may still point to a freed sctp_stream_out
entry from the previous stream state.
Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on
stream->out_curr->ext, which can lead to use-after-free once the old
stream state has been released via sctp_stream_free().
This results in crashes such as (reported by Yuqi):
BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140
Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312
CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted
7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)
sctp_sched_fcfs_dequeue+0x13a/0x140
sctp_outq_flush+0x1603/0x33e0
sctp_do_sm+0x31c9/0x5d30
sctp_assoc_bh_rcv+0x392/0x6f0
sctp_inq_push+0x1db/0x270
sctp_rcv+0x138d/0x3c10
Fix this by fully purging the association outqueue when handling the
Stale Cookie case. This ensures all pending transmit and retransmit
state is dropped, and any scheduler cached pointers are invalidated,
making it safe to rebuild stream state during COOKIE_WAIT restart.
Updating only stream->out_curr would be insufficient, since queued
and retransmittable data would still reference the old stream state and
trigger later use-after-free in dequeue paths.
Fixes:
|
||
|
CKI KWF Bot
|
43933b233c |
Merge: : Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8243 JIRA: https://redhat.atlassian.net/browse/RHEL-182345 ``` CVE: CVE-2026-53266 Backported from tree(s): linux netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit |
||
|
CKI KWF Bot
|
bf9195a2f1 |
Merge: srv6: stable backport for 9.9 phase 2
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7989 JIRA: https://redhat.atlassian.net/browse/RHEL-152701 ``` commit 06413793526251870e20402c39930804f14d59c0 Author: Minhong He <heminhong@kylinos.cn> Date: Mon Mar 16 15:33:01 2026 +0800 ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL pointer dereferences. Fixes: |
||
|
CKI KWF Bot
|
d36d81f913 |
[redhat] kernel-5.14.0-740.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
2fca06323f |
Merge: CVE-2026-43493 kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests [rhel-9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8638 JIRA: https://redhat.atlassian.net/browse/RHEL-226701 CVE: CVE-2026-43493 commit 915b692e6cb723aac658c25eb82c58fd81235110 Author: Herbert Xu <herbert@gondor.apana.org.au> Date: Thu Apr 16 17:00:50 2026 +0800 crypto: pcrypt - Fix handling of MAY_BACKLOG requests Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: Vladislav Dronov <vdronov@redhat.com> Approved-by: Thomas Huth <thuth@redhat.com> Approved-by: Lenny Szubowicz <lszubowi@redhat.com> Approved-by: Bruno Meneguele <bmeneg@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
115456b844 |
Merge: mm/memfd: Fix CVE-2026-63952
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8590 JIRA: https://redhat.atlassian.net/browse/RHEL-228526 CVE: CVE-2026-63952 Backport fix for CVE-2026-63952. The first commit is a spelling fix to make the fix apply cleanly. Signed-off-by: Luiz Capitulino <luizcap@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Herton R. Krzesinski <herton@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
0f8e050710 |
Merge: perf: Intel NVL, DMR and WCL support plus ACR and PEBS update
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8584 JIRA: https://redhat.atlassian.net/browse/RHEL-45125 JIRA: https://redhat.atlassian.net/browse/RHEL-115121 JIRA: https://redhat.atlassian.net/browse/RHEL-115123 JIRA: https://redhat.atlassian.net/browse/RHEL-115125 JIRA: https://redhat.atlassian.net/browse/RHEL-117336 JIRA: https://redhat.atlassian.net/browse/RHEL-117338 JIRA: https://redhat.atlassian.net/browse/RHEL-120358 JIRA: https://redhat.atlassian.net/browse/RHEL-95669 This batch covers multiple issues, however logically tied-together. * cstate support for Intel NVL, DMR and WCL * uncore support for Intel NVL and DMR * many fixes and pre-requisities for the uncore and core support * core PMU support for Intel NVL and DMR * ACR functionality which the NVL and DMR core take advantage of * Architectural PEBS (by Anubhav Shelat) Signed-off-by: Michael Petlan <mpetlan@redhat.com> Signed-off-by: Anubhav Shelat <ashelat@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: ashelat <ashelat@redhat.com> Approved-by: tallison1 <tallison@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
7f54b767c3 |
[redhat] kernel-5.14.0-739.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
c31260fe4e |
Merge: mm/vmscan: fix hard LOCKUP in function isolate_lru_folios
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8663 JIRA: https://issues.redhat.com/browse/RHEL-153668 Tested: sanity I've run multiple mm tests but nothing specific for this issue. Customer hit it once and didn't give further information. It is a fairly safe patch though that can prevent these from happening on other customers. Signed-off-by: Aristeu Rozanski <arozansk@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Jay Shin <jaeshin@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
ff6a06e667 |
Merge: CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8619 JIRA: https://redhat.atlassian.net/browse/RHEL-227838 CVE: CVE-2026-64560 CVE: CVE-2026-64370 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8619 By incorporating a number of posix-timers patches from the series in merge commit 9a7b0158aea7 ("Merge tag 'posix-timers-2024-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks into timers/core") and a few extra ones, the merge conflicts with the posix_cpu_timer_set() and posix_cpu_timer_rearm() functions can be eliminated. However, merge conflicts still exist for posix_cpu_timer_del() and kernel/exit.c as resolving them will require pulling in a lot more patches. This MR also includes another minor CVE-2026-64370 fix in the same posix timers code base. Signed-off-by: Waiman Long <longman@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
fc8fafb0d4 |
Merge: CVE-2026-64557: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8596 JIRA: https://redhat.atlassian.net/browse/RHEL-231355 CVE: CVE-2026-64557 * 9707a015fe8f3ba8ec7c270f3b2b8efb38823d6b Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister [linux] * 6fef032af0092ed5ccb767239a9ac1bc38c08a40 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() [linux] Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-08-10 20:44 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: David Marlin <dmarlin@redhat.com> Approved-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
809b9b6116 |
Merge: CVE-2026-52991: sched/psi: fix race between file release and pressure write
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8578 JIRA: https://redhat.atlassian.net/browse/RHEL-232556 CVE: CVE-2026-52991 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8578 This MR contains the following 3 commits. 1) commit a5b98009f16d ("sched/psi: fix race between file release and pressure write") 2) commit fadeedd7cfc5 ("sched/psi: Create the psimon kthread outside of cgroup_mutex") 3) commit 94a4acfec146 ("cgroup/psi: Set of->priv to NULL upon file release") Commit fadeedd7cfc5 relies on the last patch to correctly detect if a file release has happened after releasing and re-acquiring the lock. Signed-off-by: Waiman Long <longman@redhat.com> Approved-by: Phil Auld <pauld@redhat.com> Approved-by: Herton R. Krzesinski <herton@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e020afc405 |
Merge: CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8561
JIRA: https://redhat.atlassian.net/browse/RHEL-232106
CVE: CVE-2026-64191
Backported from tree(s): linux
```
i2c: stub: Reject I2C block transfers with invalid length
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
as the transfer length. The existing check only clamps it to avoid
overrunning the chip->words[256] register array, but does not validate
it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union
i2c_smbus_data.block buffer (34 bytes total). The driver is a
development/test tool (CONFIG_I2C_STUB=m, not built by default)
that must be loaded with a chip_addr= parameter.
A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl
with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing
stub_xfer() to read or write past the end of the union
i2c_smbus_data.block buffer:
BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)
Read of size 1 at addr ffff88800abcfd92 by task exploit/81
Call Trace:
<TASK>
stub_xfer (drivers/i2c/i2c-stub.c:223)
__i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)
i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)
i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)
i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)
__x64_sys_ioctl (fs/ioctl.c:583)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
</TASK>
The bug exists because i2c-stub implements .smbus_xfer directly,
bypassing the I2C_SMBUS_BLOCK_MAX validation in
i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same
function correctly validates against I2C_SMBUS_BLOCK_MAX, but the
I2C_SMBUS_I2C_BLOCK_DATA case does not.
Fix by rejecting transfers with data->block[0] == 0 or
data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with
both the I2C_SMBUS_BLOCK_DATA case in the same function and the
I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().
Fixes:
|
||
|
CKI KWF Bot
|
6b032e4be5 |
Merge: CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8533
JIRA: https://redhat.atlassian.net/browse/RHEL-230091
CVE: CVE-2026-64048
Backported from tree(s): linux
```
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is
reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt()
populates V2 entries starting at index 1, so when no V1 device is
selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] ==
NULL and ism_chid[0] == 0.
smc_v2_determine_accepted_chid() then matches the peer's CHID against
the array starting from index 0 using the CHID alone. A malicious
peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches
the empty slot, ini->ism_selected becomes 0, and the subsequent
ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at
offsetof(struct smcd_dev, lgr_lock) == 0x68:
BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0
Write of size 4 at addr 0000000000000068 by task exploit/144
Call Trace:
_raw_spin_lock_bh
smc_conn_create (net/smc/smc_core.c:1997)
__smc_connect (net/smc/af_smc.c:1447)
smc_connect (net/smc/af_smc.c:1720)
__sys_connect
__x64_sys_connect
do_syscall_64
Require ism_dev[i] to be non-NULL before accepting a CHID match.
Fixes:
|
||
|
CKI KWF Bot
|
baea293d47 |
Merge: [RHEL-9.9] Recent upstream fixes for IOMMU subsystem
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8411 JIRA: https://redhat.atlassian.net/browse/RHEL-213932 Upstream-Status: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Recent upstream fixes for IOMMU subsystem CVE: CVE-2026-43220 CVE: CVE-2026-43253 CVE: CVE-2026-64289 CVE: CVE-2026-53164 CVE: CVE-2026-64290 CVE: CVE-2026-64291 CVE: CVE-2026-53283 CVE: CVE-2026-64293 CVE: CVE-2026-53053 CVE: CVE-2026-53372 CVE: CVE-2025-71122 CVE: CVE-2026-68324 CVE: CVE-2026-68325 CVE: CVE-2026-68329 CVE: CVE-2026-64591 Signed-off-by: Eder Zulian <ezulian@redhat.com> Approved-by: Jerry Snitselaar <jsnitsel@redhat.com> Approved-by: Jocelyn Falempe <jfalempe@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
0483df2e89 |
Merge: Recent upstream fixes for DMA Engine drivers
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8410 JIRA: https://redhat.atlassian.net/browse/RHEL-213921 Upstream-Status: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Recent upstream fixes for DMA engine drivers Signed-off-by: Eder Zulian <ezulian@redhat.com> Approved-by: Eric Chanudet <echanude@redhat.com> Approved-by: Jerry Snitselaar <jsnitsel@redhat.com> Approved-by: jbrnak <jbrnak@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e4bf03db6c |
Merge: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8376
JIRA: https://redhat.atlassian.net/browse/RHEL-178418
Upstream Status: net.git
CVE: CVE-2026-43501
Conflicts:\
- Minor context difference as c9s lacks upstream commit 5ee6ad1dcae8 ("ipv6:
exthdrs: use swap() instead of open coding it").
commit 9e6bf146b55999a095bb14f73a843942456d1adc
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue Apr 21 15:16:33 2026 +0200
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back. The
recompressed header can be larger than the received one when the swap
reduces the common-prefix length the segments share with daddr (CmprI=0,
CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes).
pskb_expand_head() was gated on segments_left == 0, so on earlier
segments the push consumed unchecked headroom. Once skb_push() leaves
fewer than skb->mac_len bytes in front of data,
skb_mac_header_rebuild()'s call to:
skb_set_mac_header(skb, -skb->mac_len);
will store (data - head) - mac_len into the u16 mac_header field, which
wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB
past skb->head.
A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two
segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one
pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.
Fix this by expanding the head whenever the remaining room is less than
the push size plus mac_len, and request that much extra so the rebuilt
MAC header fits afterwards.
Fixes:
|
||
|
CKI KWF Bot
|
f3f328cc24 |
[redhat] kernel-5.14.0-738.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
8a24d07c4a |
Merge: smartpqi updates
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8585 JIRA: https://redhat.atlassian.net/browse/RHEL-224339 [rhkl_cover_letter_rel9.9_jira_rhel-224339](/uploads/56afc736431bca93f25dc1e6446899b8/rhkl_cover_letter_rel9.9_jira_rhel-224339) Signed-off-by: Don Brace <dbrace@redhat.com> Approved-by: djeffery1 <djeffery@redhat.com> Approved-by: Laurence Oberman <loberman@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
b40e9f2a5f |
Merge: CVE-2026-63886: scsi: target: iscsi: Validate CHAP_R length before base64 decode
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8555 JIRA: https://redhat.atlassian.net/browse/RHEL-231655 CVE: CVE-2026-63886 * 85db7391310b1304d2dc8ae3b0b12105a9567147 scsi: target: iscsi: Validate CHAP_R length before base64 decode [linux] * 7e161211f1dd5288b4ea802b30e70ef919ebc3da scsi: target: Fix hexadecimal CHAP_I handling [linux] Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-08-06 00:31 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Laurence Oberman <loberman@redhat.com> Approved-by: djeffery1 <djeffery@redhat.com> Approved-by: Chris Leech <cleech@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
dc12c63bbf |
Merge: [RHEL - 9.9]: select intel tpmi/plr unbind fixes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8470 JIRA: https://redhat.atlassian.net/browse/RHEL-212707 RHEL is missing the following upstream commits: 57c347a2e247 platform/x86: intel: Add notifiers support 14473e8c4e97 platform/x86/intel/tpmi/plr: Prevent fault during unbind Signed-off-by: Dennis Chen <dechen@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
dcd7dc0dee |
Merge: [RHEL 9.9]: x86/fpu: Ensure XFD state on signal delivery
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8465 JIRA: https://redhat.atlassian.net/browse/RHEL-212652 commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9 Author: Chang S. Bae <chang.seok.bae@intel.com> Date: Mon Jun 9 17:16:59 2025 -0700 x86/fpu: Ensure XFD state on signal delivery Sean reported [1] the following splat when running KVM tests: WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70 Call Trace: <TASK> fpu__clear_user_states+0x9c/0x100 arch_do_signal_or_restart+0x142/0x210 exit_to_user_mode_loop+0x55/0x100 do_syscall_64+0x205/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Chao further identified [2] a reproducible scenario involving signal delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR. When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption. Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature. This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible. [ dhansen: minor changelog munging ] Closes: https://lore.kernel.org/lkml/aDCo_SczQOUaB2rS@google.com [1] Fixes: 672365477ae8a ("x86/fpu: Update XFD state where required") Reported-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Reviewed-by: Chao Gao <chao.gao@intel.com> Tested-by: Chao Gao <chao.gao@intel.com> Link: https://lore.kernel.org/all/aDWbctO%2FRfTGiCg3@intel.com [2] Cc:stable@vger.kernel.org Link: https://patch.msgid.link/20250610001700.4097-1-chang.seok.bae%40intel.com (cherry picked from commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9) Assisted-by: Patchpal Signed-off-by: Dennis Chen <dechen@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
a1ea784b42 |
Merge: [RHEL 9.9]: platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8464 JIRA: https://redhat.atlassian.net/browse/RHEL-212719 Upstream status: v7.1 RHEL is missing commit 348ccc754d89 ("platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery"). Conflicts: - drivers/platform/x86/intel/vsec.c::intel_vsec_pci_probe(): Remove const qualifiers to avoid 9577c74c96f8 ("platform/x86/intel/vsec: Make driver_data info const") Assisted-by: Patchpal Signed-off-by: Dennis Chen <dechen@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
86ddd0217f |
Merge: ALSA - update drivers for 9.9 - upstream 7.1.5 (stable)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8435 JIRA: https://issues.redhat.com/browse/RHEL-193254 This upstream patchset updates the ALSA driver code to upstream stable 7.1.5 kernel. Omitted-fix: dd1bfaf9413e9c8a0fcfb45dcb735c6768a45251 # see commit - this revert is for 7.2+ kernel code Omitted-fix: 99c159279c6dfa2c4867c7f76875f58263f8f43b # used hash 225d70b8074502acee3943bf0c2e839e867cd38c for backport - already in RHEL kernel Signed-off-by: Jaroslav Kysela <jkysela@redhat.com> Approved-by: Krzysztof Pawlinski <kpawlins@redhat.com> Approved-by: Desnes Nunes <desnesn@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
d4b1ffb1fe |
Merge: KVM: Revisit kvm_arch_set_irq_inatomic optimization
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8403 JIRA: https://redhat.atlassian.net/browse/RHEL-136457 commits ``` d41993f71385 ("KVM: s390: get rid of gmap_translate()") c9a568838086 ("KVM: s390: Add map/unmap ioctl and clean mappings post-guest") 1e95e3bc6b05 ("KVM: s390: Enable adapter_indicators_set to use mapped pages") a868b30492c5 ("KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject") 9972befc3e34 ("KVM: s390: Fall back to short-term pinning in MAP ioctl" cherry picked from kvms390/linux.git) ``` Conflicts: Target code does not have kzalloc_obj(), replaced usages with kzalloc(). Target code does not have ind_gaddr and summary_gaddr, replace usages with ind_addr and summary_addr. interrupt.c: Manual merge of kvm_set_routing_entry() Signed-off-by: Christoph Schlameuss <cschlame@redhat.com> --- v7: - rebased with conflict resolution in interrupt.c v6: - rebased - moved spin_unlock_irqrestore() in __deliver_service() to correct patch v5: - added final commit from maintainer tree v4: - TBD commit is about to be picked by maintainers, will adjust the hash as soon as it is in a maintainer tree Approved-by: Cornelia Huck <cohuck@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
789b1c9c2d |
Merge: netfilter: nfnetlink_queue: optimize verdict lookup with hash table
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8357 JIRA: https://redhat.atlassian.net/browse/RHEL-150728 The current implementation uses a linear list to find queued packets by ID when processing verdicts from userspace. With large queue depths and out-of-order verdicting, this O(n) lookup becomes a significant bottleneck, causing userspace verdict processing to dominate CPU time. Replace the linear search with a hash table for O(1) average-case packet lookup by ID. A global rhashtable spanning all network namespaces attributes hash bucket memory to kernel but is subject to fixed upper bound. Also includes the relevant selftest changes. Most changes to the selftests here are dependencies. SCTP and UDPGRO test not backported, SCTP was very flaky and would need more followups, UDPGRO test would fail because we lack the relevant nfqueue fixes. Omitted-fix: 4e97d521c2be094718c4c5c7c4f785e8972b4af0 ("selftests: netfilter: nft_queue.sh: sctp coverage") Unrelated to this feature Omitted-fix: 59ecffa3995e70a675beeb870f0b3a28470428de ("selftests: netfilter: nft_queue.sh: add udp fraglist gro test case") ) Unrelated to this feature and would need a lot more backporting work. Signed-off-by: Florian Westphal <fwestpha@redhat.com> Approved-by: Phil Sutter <psutter@redhat.com> Approved-by: Eric Garver <egarver@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5b1e3a510f |
Merge: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8340 JIRA: https://redhat.atlassian.net/browse/RHEL-186591 This issue is specific to kernel-rt and has already been addressed in RHEL-10 with recent updates. As stated in the commit description: On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute rt6_make_pcpu_route() and successfully install a pcpu_rt entry. When the first task resumes execution, its cmpxchg() in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding mdelay() after rt6_get_pcpu_route(). Using preempt_disable/enable is not appropriate here because ip6_rt_pcpu_alloc() may sleep. Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT: free our allocation and return the existing pcpu_rt installed by another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT kernels where such races should not occur. In order to fix this problem, backport the followin upstream commit: 1adaea51c61b ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT Signed-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: Wander Lairson Costa <wander@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
3df9cdee80 |
Merge: CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8278
JIRA: https://redhat.atlassian.net/browse/RHEL-188519
CVE: CVE-2026-53000
Backported from tree(s): linux
```
netfilter: nat: use kfree_rcu to release ops
Florian Westphal says:
"Historically this is not an issue, even for normal base hooks: the data
path doesn't use the original nf_hook_ops that are used to register the
callbacks.
However, in v5.14 I added the ability to dump the active netfilter
hooks from userspace.
This code will peek back into the nf_hook_ops that are available
at the tail of the pointer-array blob used by the datapath.
The nat hooks are special, because they are called indirectly from
the central nat dispatcher hook. They are currently invisible to
the nfnl hook dump subsystem though.
But once that changes the nat ops structures have to be deferred too."
Update nf_nat_register_fn() to deal with partial exposition of the hooks
from error path which can be also an issue for nfnetlink_hook.
Fixes:
|
||
|
CKI KWF Bot
|
1af6f88517 |
Merge: tcp: support for TCP_AO
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8057 JIRA: https://redhat.atlassian.net/browse/RHEL-142637 CVE: CVE-2025-39852 CVE: CVE-2026-43384 CVE: CVE-2025-39950 CVE: CVE-2024-43887 CVE: CVE-2024-40985 CVE: CVE-2024-27394 Upstream Status: all mainline in net.git, except Kconfig and RPM specfile Omitted-fix: 3f36781e57b3 ("selftests/net: Add mixed select()+polling mode to TCP-AO tests"): a fix for flaky test on slow machines, whose backport on c9s is not trivial Omitted-fix: 9d58d14e3a18 ("crypto: api - Fold __crypto_alloc_tfmgfp() into __crypto_alloc_tfm()"): crypto_tfm rework not needed Omitted-fix: 0200de9d75b1 ("crypto: api - Fold crypto_alloc_tfmmem() into crypto_create_tfm_node()"): crypto_tfm rework not needed Omitted-fix: 3065170bfc7f ("crypto: api - Remove per-tfm refcount"): crypto_tfm rework not needed Omitted-fix: e1a9d3cc1182 ("tcp: initialize standalone TCP-AO response padding"): missing TCP NOP to pad TCP_AO option. Will follow-up with another MR Tested: - successful build with and without CONFIG_TCP_AO - ran kselftests in net/tcp_ao, all PASS Depends:!7999 patch 1-10 add support for cmac/hmac/hash cloning patch 11-12 are fixes for cmac/hmac/hash cloning patch 13-21 are needed to reduce conflicts patch 22-44 backport TCP_AO functionality from upstream patch 45-72 contain fixes+follow-ups patch 73-103 contain kselftests + fixes found while developing kselftests patch 104-108 contain later fixes patch 109 enable TCP_AO in c9s config patch 110 adds tcp_ao kselftests to kernel-selftests-internal RPM Signed-off-by: Davide Caratti <dcaratti@redhat.com> Approved-by: Jan Stancek <jstancek@redhat.com> Approved-by: Paolo Abeni <pabeni@redhat.com> Approved-by: Thomas Huth <thuth@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
54ebc1655b |
Merge: iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8041 JIRA: https://issues.redhat.com/browse/RHEL-155154 * iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 Signed-off-by: Petr Oros <poros@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Michal Schmidt <mschmidt@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
7628f49232 |
[redhat] kernel-5.14.0-737.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
f7d0c7a526 |
Merge: CIFS: fix broken directory listing against old SMB1 servers [rhel-9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8589 - fix broken directory listing against old SMB1 servers JIRA: https://redhat.atlassian.net/browse/RHEL-222675 Signed-off-by: Paulo Alcantara <paalcant@redhat.com> Approved-by: David Howells <dhowells@redhat.com> Approved-by: Scott Mayhew <smayhew@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
034a36f190 |
Merge: vhost: reset the vring metadata cache on vring reconfiguration [9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8475
JIRA: https://redhat.atlassian.net/browse/RHEL-224537
Backported from tree(s): linux
```
vhost: reset the vring metadata cache on vring reconfiguration
vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring
metadata region, and iotlb_access_ok() returns early on a cache hit,
taking the hit as proof that the region has already been validated:
if (vhost_vq_meta_fetch(vq, addr, len, type))
return true;
The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on
device IOTLB (re)initialisation and on vq reset, but not when
VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when
VHOST_SET_VRING_NUM changes the region sizes.
With a device IOTLB attached both ioctls are accepted while the vq is
live, and neither validates the addresses at ioctl time: vq_access_ok()
and vq_log_used_access_ok() return true early because the addresses are
GIOVAs, deferring validation to prefetch time. Once the cache has been
populated that deferred validation no longer runs -- vq_meta_prefetch()
hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps
translating through the old mapping as
map->addr + addr - map->start
for an address the mapping no longer covers. vhost_copy_to_user() and
vhost_copy_from_user() consume the result with __copy_to_user() and
__copy_from_user(), which do not check it either, so a subsequent used
ring update or descriptor fetch accesses memory outside the region the
IOTLB actually maps.
Reset the metadata cache whenever the vring is reconfigured, so the new
addresses are pushed back through iotlb_access_ok()'s slow path.
Fixes:
|
||
|
CKI KWF Bot
|
4abb008e5d |
Merge: Select fixes for thermal/intel
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8460 JIRA: https://issues.redhat.com/browse/RHEL-212721 RHEL9 is missing the following upstream commits: 1fac72873549 thermal: intel: int340x: Fix potential shift overflow in ptc_mmio_write() b91d287fa7a1 thermal: intel: Fix dangling resources on thermal_throttle_online() failure Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
9dbe02b82e |
Merge: bnxt_en: Fix NULL pointer dereference
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8287
JIRA: https://redhat.atlassian.net/browse/RHEL-185084
Backported from tree(s): linux
```
bnxt_en: Fix NULL pointer dereference
PCIe errors detected by a Root Port or Downstream Port cause error
recovery services to run on all subordinate devices regardless of
administrative state.
The .error_detected() callback, bnxt_io_error_detected(), disables
and synchronizes IRQs via bnxt_disable_int_sync(), which calls
bnxt_cp_num_to_irq_num() to map completion rings to IRQs using
bp->bnapi.
Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe
error recovery on a closed NIC can dereference a NULL pointer.
Check if bp->bnapi is NULL before disabling and synchronizing IRQs.
Fixes:
|
||
|
CKI KWF Bot
|
25d5ed9c78 |
[redhat] kernel-5.14.0-736.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
7b3b46081a |
Merge: SELinux TCP/MPTCP connect check bypass via TCP Fast Open
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8474 JIRA: https://redhat.atlassian.net/browse/RHEL-222801 Backported from tree(s): linux ``` selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update its socket_sendmsg() hook to call selinux_socket_connect() when MSG_FASTOPEN is passed. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/ Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/ Reported-by: Bryam Vargas <hexlabsecurity@proton.me> Reported-by: Matthieu Buffet <matthieu@buffet.re> Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> Tested-by: Bryam Vargas <hexlabsecurity@proton.me> Signed-off-by: Paul Moore <paul@paul-moore.com> (cherry picked from commit 44c74d27d1b9aaa99fa8a83640c1223575262b80) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-08-05 13:33 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Ondrej Mosnáček <omosnacek@gmail.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
019e7f4a24 |
Merge: i2c: core: fix adapter deregistration race
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8472
JIRA: https://issues.redhat.com/browse/RHEL-222902
CVE: CVE-2026-64279
commit b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f
Author: Johan Hovold <johan@kernel.org>
Date: Mon May 11 16:37:13 2026 +0200
i2c: core: fix adapter deregistration race
Adapters can be looked up by their id using i2c_get_adapter() which
takes a reference to the embedded struct device.
Remove the adapter from the IDR before tearing it down during
deregistration (and on registration failure) to make sure its resources
are not accessed after having been freed (e.g. the device name).
Fixes:
|
||
|
CKI KWF Bot
|
f8efac2116 |
Merge: ARM64: Mitigate TLBI errata on various CPUs
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8462 JIRA: https://redhat.atlassian.net/browse/RHEL-183626 CVE: CVE-2025-10263 Mitigate TLBI errata on: Azure Cobalt 100 Nvidia Olympus Cortex A76, A76AE Cortex A77 Cortex A78, A78AE, A78C Cortex A710 Cortex X1, X1C, X2, X3, X4 Cortex X925 Cortex N1, N2 Cortex V1, V2, V3, V3AE C1-Premium, C1-Ultra Signed-off-by: Mark Salter <msalter@redhat.com> Approved-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: Steve Dunnagan <sdunnaga@redhat.com> Approved-by: Jennifer Berringer <jberring@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e0c9ff6cde |
Merge: platform/x86/amd/hsmp: Clamp ioctl/send_message indices (Spectre v1)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8461 JIRA: https://issues.redhat.com/browse/RHEL-217011 commit d20457b46eca76b9bb716dd31af591cad21607b5 Author: Muralidhara M K <muralidhara.mk@amd.com> Date: Fri Jun 12 09:56:08 2026 +0530 platform/x86/amd/hsmp: Clamp ioctl/send_message indices (Spectre v1) Although validate_message() checks msg_id, a mispredicted branch can still allow speculative indexing into hsmp_msg_desc_table[]. Clamp msg.msg_id with array_index_nospec() at entry to hsmp_ioctl_msg() so downstream dereferences (including via is_get_msg() and hsmp_send_message()) see a bounded index. Similarly, hsmp_send_message() bounds-checks msg->sock_ind before indexing hsmp_pdev.sock[], but a mispredicted branch can still speculatively use the raw index (Spectre v1, CVE-2017-5753). Apply array_index_nospec() after the check so every caller that reaches hsmp_pdev.sock[] through this helper sees a clamped socket index—including hsmp_ioctl_msg() and any other path that hands a user-derived struct hsmp_message to hsmp_send_message(). Reviewed-by: Muthusamy Ramalingam <muthusamy.ramalingam@amd.com> Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com> Link: https://patch.msgid.link/20260612042610.1629037-7-muralidhara.mk@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
bc375e5026 |
Merge: pinctrl-amd: Don't clear S4 wake bits at probe
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8441 JIRA: https://issues.redhat.com/browse/RHEL-211144 commit ffe8a0c6b55285ceaf2f42fc20c3a0594d14f1e9 Author: Mario Limonciello <mario.limonciello@amd.com> Date: Mon Jul 20 11:28:44 2026 -0500 pinctrl-amd: Don't clear S4 wake bits at probe commit 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") introduced a regression where Wake-on-LAN no longer works after suspend or shutdown on some AMD platforms. Firmware-programmed S4 wake bits for devices like PCIe NICs using PCI PME are cleared at probe, but nothing restores them. Unlike S0i3/S3 wake sources that use enable_irq_wake() -> amd_gpio_irq_set_wake(), PCIe PME does not use GPIO IRQ infrastructure and relies on firmware configuration. The original intent of commit 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") was to clear spurious wake bits left by firmware to prevent unwanted wakeups. However, S4 wake bits are used for hardware-level wake sources like WoL that bypass the kernel's IRQ wake API. Fix by preserving S4 wake bits at probe and only clearing S0i3/S3 bits: - Firmware-configured S4 wake sources (WoL) continue working - Kernel maintains control of S3/S0i3 wake policy via set_wake() - S3-only wake sources work correctly per commit f31f33dbb3ba ("pinctrl: amd: Take suspend type into consideration which pins are non-wake") The trade-off is that firmware-programmed spurious S4 wake bits remain set, but this is less problematic than breaking WoL. Fixes: 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Linus Walleij <linusw@kernel.org> Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f61540d679 |
Merge: Select fs/resctrl fixes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8440 JIRA: https://issues.redhat.com/browse/RHEL-216442 A number of fixes have landed upstream that should be included in RHEL. Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Approved-by: Gavin Shan <gshan@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
56bf8d01e8 |
Merge: KVM: kvm fixes for 2026-07-21
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8407 KVM: kvm fixes for 2026-07-21 JIRA: https://redhat.atlassian.net/browse/RHEL-211279 JIRA: https://redhat.atlassian.net/browse/RHEL-213339 CVE: CVE-2025-40026 CVE: CVE-2026-63807 Commits: ``` KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level KVM: nVMX: Hide shadow VMCS right after VMCLEAR KVM: x86: Check for invalid/obsolete root *after* making MMU pages available KVM: nVMX: Add helper to put (unmap) vmcs12 pages KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O ``` Signed-off-by: Aidan Wallace <awallace@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Approved-by: Peter Xu <peterx@redhat.com> Approved-by: Jay Shin <jaeshin@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
9a7ab8ac04 |
Merge: ARM CSPMU patches in preparation for Vera platforms
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8386 JIRA: https://issues.redhat.com/browse/RHEL-121676 Backport preparatory patch series for ARM CoreSight PMU (CSPMU) to support NVIDIA T410 Performance Monitoring Unit on Vera platforms. Signed-off-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: Mark Salter <msalter@redhat.com> Approved-by: Mark Langsdorf <mlangsdo@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
b16a02ffb5 |
Merge: fixup! Merge: s390/entry: Scrub r12 register on kernel entry
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8331 JIRA: https://redhat.atlassian.net/browse/RHEL-191803 commit 0738d395aab8fae3b5a3ad3fc640630c91693c27 Author: Vasily Gorbik gor@linux.ibm.com Date: Thu Mar 26 19:50:14 2026 +0100 s390/entry: Scrub r12 register on kernel entry Before commit f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP"), all entry handlers loaded r12 with the current task pointer (lg %r12,__LC_CURRENT) for use by the BPENTER/BPEXIT macros. That commit removed TIF_ISOLATE_BP, dropping both the branch prediction macros and the r12 load, but did not add r12 to the register clearing sequence. Add the missing xgr %r12,%r12 to make the register scrub consistent across all entry points. Fixes: f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP") Cc: stable@kernel.org Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Jan Polensky <jpolensk@redhat.com> Approved-by: Daniel Horak <dhorak@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
550013cad9 |
Merge: rtc: rx8111: Enable driver for Epson RX8111
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8317 Enable the Epson RX8111 RTC driver JIRA: https://issues.redhat.com/browse/RHEL-184760 Performed a basic test to see that the driver was loaded on a Siemens BX-35A device. Signed-off-by: Nirmala Dalvi <ndalvi@redhat.com> Approved-by: Jennifer Berringer <jberring@redhat.com> Approved-by: Rupinderjit Singh <rusingh@redhat.com> Approved-by: mkopelev <mkopelev@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f2944db641 |
Merge: CVE-2026-52923 kernel: ipc: limit next_id allocation to the valid ID range [rhel-9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8301 JIRA: https://redhat.atlassian.net/browse/RHEL-188213 CVE: CVE-2026-52923 commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 Author: Linpu Yu <linpu5433@gmail.com> Date: Sun May 10 13:43:30 2026 +0800 ipc: limit next_id allocation to the valid ID range Signed-off-by: Rafael Aquini <raquini@redhat.com> Approved-by: Luiz Capitulino <luizcap@redhat.com> Approved-by: Phil Auld <pauld@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
c2c949a295 |
[redhat] kernel-5.14.0-735.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
21a60185db |
Merge: CVE-2026-64531: net: openvswitch: reject oversized nested action attrs
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8439 JIRA: https://redhat.atlassian.net/browse/RHEL-222498 CVE: CVE-2026-64531 Backported from tree(s): linux ``` net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure. Fixes: a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") Cc: stable@vger.kernel.org Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me> Reviewed-by: Eelco Chaudron <echaudro@redhat.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260706094336.38639-1-manizada@pm.me Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit 3f1f755366687d051174739fb99f7d560202f60b) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-07-31 12:10 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Timothy Redaelli <tredaelli@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5fd73ab01f |
Merge: hung_task: selected improvements
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8405
JIRA: https://issues.redhat.com/browse/RHEL-146503
This MR brings three small improvements to hung_task detector. The upstream
commit
|
||
|
CKI KWF Bot
|
406e208e0c |
Merge: futex: Optimize futex hash bucket access patterns
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8401 JIRA: https://redhat.atlassian.net/browse/RHEL-212733 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8401 Omitted-fix: fa188edc671d ("linux/bitfield.h: replace __auto_type with auto") Omitted-fix: 8fedac321fb0 ("mm/mempolicy: fix weighted interleave auto sysfs name") Not needed because RHEL9 doesn't have commit e341f9c3c841 ("mm/mempolicy: Weighted Interleave Auto-tuning") which introduces the "auto" sysfs file. This MR backports commit a734d9fca84e ("futex: Optimize futex hash bucket access patterns") to improve the futex hashing performance as measured by the "perf bench futex hash" benchmark to a level comparable with that of RHEL 9.7. Patch 1 is a dependency that is used to simplify the backport. When running the “perf bench futex hash” benchmark on a 2-sock 96-thread CascadeLake test system, the test results before and after the patch are as follows: ``` Baseline Patched Delta -b 16 143,724 158,095 +10.0% -b 64 214,471 282,900 +32.0% -b 256 540,852 716,517 +32.5% -b 512 768,584 1,041,867 +35.6% -b 1024 964,341 1,277,484 +32.5% -b 4096 1,625,843 1,671,285 + 2.8% -b 16384 1,663,403 1,710,355 + 2.8% -b 65536 1,747,447 1,819,797 + 4.1% ``` Signed-off-by: Waiman Long <longman@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Phil Auld <pauld@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
55706e41c1 |
Merge: Wireless core and drivers rebase to v7.1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8320 JIRA: https://issues.redhat.com/browse/RHEL-186475 Tested: basic testing with several supported WiFi cards (Intel, Qualcomm, Mediatek and Realtek). Wireless core and drivers update to v7.1 Upstream status: linux.git Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8309 Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8206 Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8130 Not supported drivers: Omitted-fix: c882b7a603ef wifi: at76c50x: drop redundant device reference Omitted-fix: ea06baf59bd4 wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() Omitted-fix: 32a0e1c63cdf wifi: ipw2x00: Use michael_mic() from cfg80211 Omitted-fix: 75e375816392 wifi: libertas: drop redundant device reference Omitted-fix: b1af0de313bd wifi: libertas_tf: drop redundant device reference Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5683e4bffe |
Merge: mhi bus update to 7.1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8309 JIRA: https://redhat.atlassian.net/browse/RHEL-186474 MHI bus rebase to linux kernel upstream version v7.1 It will be used by Wireless (Wifi and WWAN) and automotive components. Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8206 Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8130 Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com> Approved-by: Mattijs Korpershoek <mkorpershoek@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e05a2338f5 |
[redhat] kernel-5.14.0-734.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
4e4ce5c460 |
Merge: Sync CIFS/smbdirect with upstream [rhel-9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8450 - Sync CIFS/smbdirect with upstream JIRA: https://issues.redhat.com/browse/RHEL-216926 Signed-off-by: Paulo Alcantara <paalcant@redhat.com> Omitted-fix: fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()") Approved-by: Roberto Bergantinos Corpas <rbergant@redhat.com> Approved-by: Scott Mayhew <smayhew@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
4c37a8dfbc |
Merge: rtla: Stop the record trace on interrupt && rtla/timerlat_top: Fix on-threshold actions firing on signal [rhel-9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8424 # Merge Request Required Information JIRA: https://redhat.atlassian.net/browse/RHEL-207773 ## Summary of Changes Tl;dr: RTLA 7.1 rebase MR (https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7953) pulled in an incorrect fix of an earlier issue that together with another oversight lead to a bug in on-threshold actions of rtla-timerlat-top tool (see the JIRA for details); this pulls in fixes for both. ## Approved Development Ticket(s) All submissions to CentOS Stream must reference a ticket in [Red Hat Jira](https://issues.redhat.com/). <details><summary>Click for formatting instructions</summary> Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/centos-stream-docs/contributors-guide/) for how to file this ticket and have it approved. List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate. </details> Signed-off-by: Tomas Glozar <tglozar@redhat.com> Approved-by: Wander Lairson Costa <wander@redhat.com> Approved-by: Gabriele Monaco <gmonaco@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
d318f69451 |
Merge: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8422 # Merge Request Required Information ## Summary of Changes JIRA: https://redhat.atlassian.net/browse/RHEL-213219 CVE: CVE-2026-63888 Fix a buffer overread and a potential double free of a stale pointer ## Approved Development Ticket(s) All submissions to CentOS Stream must reference a ticket in [Red Hat Jira](https://issues.redhat.com/). <details><summary>Click for formatting instructions</summary> Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/centos-stream-docs/contributors-guide/) for how to file this ticket and have it approved. List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate. </details> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Approved-by: djeffery1 <djeffery@redhat.com> Approved-by: Chris Leech <cleech@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
84a1cee016 |
Merge: dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8381 JIRA: https://redhat.atlassian.net/browse/RHEL-212062 Backported from tree(s): net ``` dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() When a dpll_pin is shared across multiple dpll_device instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync(). This happens under the following conditions: - A pin is registered with two or more dpll devices (dpll_A, dpll_B) - The pin has ref_sync pairs with other pins - During unregistration of dpll_A's pins, a ref_sync partner pin is unregistered first, removing it from dpll_A->pin_refs - But since the partner pin is still registered with dpll_B, its dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT run and the partner stays in the pin's ref_sync_pins xarray - When the pin itself is then unregistered from dpll_A, the delete notification calls dpll_msg_add_pin_ref_sync() which finds the partner in ref_sync_pins, passes dpll_pin_available() (partner is still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A, partner) returns NULL because partner was already removed from dpll_A->pin_refs - The NULL priv pointer is passed to the driver's ref_sync_get callback, which dereferences it BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x] Call Trace: dpll_msg_add_pin_ref_sync+0xb8/0x200 dpll_cmd_pin_get_one+0x3b6/0x4b0 dpll_pin_event_send+0x72/0x140 __dpll_pin_unregister+0x5a/0x2b0 dpll_pin_unregister+0x49/0x70 Fix this by skipping ref_sync pins whose priv pointer cannot be resolved for the current dpll device. Fixes: 58256a26bfb3 ("dpll: add reference sync get/set") Signed-off-by: Ivan Vecera <ivecera@redhat.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260710193625.1378822-1-ivecera@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit d2e914a4a0d0f753dbae830264850d044026167c) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-07-17 13:10 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: Michal Schmidt <mschmidt@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e604f77a4e |
Merge: ice: Tx ref clock feature
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8354 JIRA: https://redhat.atlassian.net/browse/RHEL-193816 Depends: !8346 Depends: !8353 Backport the upstream ice driver patches for the Tx ref clock feature. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: Petr Oros <poros@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
88f16c938d |
Merge: qede: build_skb failure causes off-by-one BD ring corruption and kernel panic
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8350
JIRA: https://redhat.atlassian.net/browse/RHEL-193044
Backported from tree(s): net
```
qede: fix off-by-one in BD ring consumption on build_skb failure
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.
Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")
added a NULL check inside qede_build_skb() to prevent a NULL pointer
dereference, but did not address the missing NULL checks in the
callers, making this off-by-one reachable.
Fix this by adding NULL checks for the return value of
qede_build_skb() in both qede_rx_build_skb() and
qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring
manipulation.
Fixes:
|
||
|
CKI KWF Bot
|
e2435d0819 |
Merge: [RHEL-9.9] x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8310 JIRA: https://redhat.atlassian.net/browse/RHEL-188795 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=71174970 Upstream status: v7.1 CVE: CVE-2025-54518 Conflicts: - arch/x86/kernel/cpu/amd.c: Omitted contextual differences added by a74bb5f202da ("x86/CPU/AMD: Disable INVLPGB on Zen2") and 5b937a1ed64e ("x86/rdrand: Disable RDSEED on AMD Cyan Skillfish") not present in RHEL 9 commit c21b90f77687075115d989e53a8ec5e2bb427ab1 Author: Prathyushi Nangia <prathyushi.nangia@amd.com> Date: Tue Dec 9 10:01:33 2025 -0600 x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure resources are not improperly shared in the op cache and cause instruction corruption this way. Signed-off-by: Prathyushi Nangia <prathyushi.nangia@amd.com> Co-developed-by: Borislav Petkov (AMD) <bp@alien8.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Assisted-by: Patchpal Signed-off-by: Dennis Chen <dechen@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
9849b947ca |
Merge: redhat: sign UKI's inner vmlinuz with modules signing key
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8071 JIRA: https://redhat.atlassian.net/browse/RHEL-223629 The existing workflow which puts SB-signed vmlinuz in the UKI and then SB-signs the UKI itself may be problematic for the situation when build time signing is unavailable. Switch to using the transient module signing key for signing vmlinuz which gets included into the UKI. This ensures that the extracted vmlinuz can be used for kexec/kdump. Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Approved-by: Jan Stancek <jstancek@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f343ba5ada |
[redhat] kernel-5.14.0-733.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
8d247149ed |
Merge: CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8433
JIRA: https://redhat.atlassian.net/browse/RHEL-219617
CVE: CVE-2026-64320
Backported from tree(s): linux
```
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
nvmet_execute_disc_get_log_page() validates only the dword alignment
of the host-supplied Log Page Offset (lpo). The 64-bit offset is then
added to a small kzalloc'd buffer that holds the discovery log page
and the result is passed straight to nvmet_copy_to_sgl(), which
memcpy()s data_len bytes out to the host with no source-side bound
check:
u64 offset = nvmet_get_log_page_offset(req->cmd); /* 64-bit host */
size_t data_len = nvmet_get_log_page_len(req->cmd); /* 32-bit host */
...
if (offset & 0x3) { ... } /* only check */
...
alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);
buffer = kzalloc(alloc_len, GFP_KERNEL);
...
status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);
The Discovery controller is unauthenticated -- nvmet_host_allowed()
returns true unconditionally for the discovery subsystem -- so the call
is reachable pre-authentication by any TCP/RDMA/FC peer that can reach
the nvmet target. With a discovery log page of ~1 KiB, an attacker
requesting up to 4 KiB starting at offset == alloc_len reads the next
slab page out and gets its content returned over the fabric (an
empirical run on a default nvmet-tcp loopback target leaked 81
canonical kernel pointers in one Get Log Page response). Pointing the
offset at unmapped kernel memory faults the in-kernel memcpy and
crashes (or panics, on panic_on_oops=1) the target host instead.
The attacker-controlled source-side offset pattern
"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)" is unique
to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every
other Get Log Page handler in admin-cmd.c either ignores lpo (and
silently starts every response at offset 0) or tracks a local
destination offset with a fixed source pointer.
Validate the host-supplied offset against the log page size, cap the
copy length to what is actually available, and zero-fill any remainder
of the host transfer buffer. The zero-fill matches the existing
short-response pattern in nvmet_execute_get_log_changed_ns()
(admin-cmd.c) and prevents leaking transport SGL contents when the
host asks for more bytes than the log page contains.
Fixes:
|
||
|
CKI KWF Bot
|
a79424b8dc |
Merge: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8392
JIRA: https://redhat.atlassian.net/browse/RHEL-212990
Backported from tree(s): linux
```
net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using
the PF's log_max_current_uc/mc_list capabilities. When querying a VF
vport with a larger configured max (via devlink), the firmware response
can overflow this buffer:
BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core]
Read of size 4 at addr ff1100013ffc8a12 by task kworker/u96:2/385
CPU: 12 UID: 0 PID: 385 Comm: kworker/u96:2 Not tainted 7.0.0-rc6+ #1 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core]
Call Trace:
<TASK>
dump_stack_lvl+0x69/0xa0
print_report+0x176/0x4e4
kasan_report+0xc8/0x100
mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core]
esw_update_vport_addr_list+0x2e3/0xda0 [mlx5_core]
esw_vport_change_handle_locked+0xa1f/0x1060 [mlx5_core]
esw_vport_change_handler+0x6a/0x90 [mlx5_core]
process_one_work+0x87f/0x15e0
worker_thread+0x62b/0x1020
kthread+0x375/0x490
ret_from_fork+0x4dc/0x810
ret_from_fork_asm+0x11/0x20
</TASK>
Fix by querying the vport's own HCA caps to size the buffer correctly.
Refactor the function to allocate and return the MAC list internally,
removing the caller's dependency on knowing the correct max.
Fixes:
|
||
|
CKI KWF Bot
|
16b126903e |
Merge: DRM Stable Backport (v7.0.14)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8272 The DRM backport's goal is to backport all the changes in the DRM subsystem to the kernel target version, with the biggest value being that we get the upstream hardware enablement (and bug fixes) into RHEL. After the [7.0 DRM Backport](https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8121), this MR backport as many fixes from the linux-stable tree for the target version: v7.0.13 Other: JIRA: https://issues.redhat.com/browse/RHEL-180329 Signed-off-by: Anusha Srivatsa <asrivats@redhat.com> Approved-by: Eric Chanudet <echanude@redhat.com> Approved-by: José Expósito <jexposit@redhat.com> Approved-by: John Wiele <jwiele@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
66eed0fcb5 |
[redhat] kernel-5.14.0-732.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
fb579173ca |
Merge: [RHEL-9.9] crypto: tegra - fix rctx->cryptlen calculation
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8466 JIRA: https://redhat.atlassian.net/browse/RHEL-168738 Backported from tree(s): crypto, cryptodev ``` crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer. As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively. Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") Signed-off-by: Vladislav Dronov <vdronov@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> (cherry picked from commit 360f2974fcea49c61f6d6f81554741a9eeee7168) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-08-03 21:40 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Vladislav Dronov <vdronov@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
93c6c3703d |
Merge: xfrm: fix three CVE and one race issues
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8437 JIRA: https://redhat.atlassian.net/browse/RHEL-180034 JIRA: https://redhat.atlassian.net/browse/RHEL-154906 JIRA: https://redhat.atlassian.net/browse/RHEL-180173 JIRA: https://redhat.atlassian.net/browse/RHEL-178340 CVE: CVE-2025-39797 CVE: CVE-2026-23239 CVE: CVE-2026-46116 Fix three CVE and one race issues Signed-off-by: Xin Long <lxin@redhat.com> Approved-by: Íñigo Huguet <ihuguet@riseup.net> Approved-by: Sabrina Dubroca <sdubroca@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
006970f36d |
Merge: redhat: Add DENYLIST.rhel to BPF selftests
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8431 JIRA: https://redhat.atlassian.net/browse/RHEL-213547 Upstream Status: RHEL only ARK: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/4426 Conflicts: Necessary context changes in kernel.spec.template file caused by RHEL9 missing numerous commits compared to ARK. The list of tests on DENYLIST were reduced down to a single test as the rest of the tests are either not in RHEL9 or they are passing. Additional details are provided in the attached JIRA issue. ``` commit e325a62142ca8d5a4fde32b1ed8b32f24cfd5e96 Author: Viktor Malik <vmalik@redhat.com> Date: Mon Mar 30 15:03:17 2026 +0200 redhat: Add DENYLIST.rhel to BPF selftests Upstream status: RHEL only BPF upstream requires specific kernel configuration (defined in tools/testing/selftests/bpf/config*) for the BPF selftests to pass. RHEL does not enable some of the required options and therefore some test cases cannot pass. Upstream uses the DENYLIST file to filter out buggy and flaky tests. To respect that, add a new file DENYLIST.rhel containing the aforementioned test cases. During RPM build, we append the file contents to the global DENYLIST that is now also copied to kernel-selftests-internal. DENYLIST can be applied in test_progs with: # ./test_progs -d @DENYLIST Signed-off-by: Viktor Malik <vmalik@redhat.com> ``` Signed-off-by: Veronika Molnarova <vmolnaro@redhat.com> Approved-by: Viktor Malik <vmalik@redhat.com> Approved-by: Jan Stancek <jstancek@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |