mirror of
https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
synced 2026-09-09 00:08:12 +08:00
77af58432d5eb888320a29509606e534794e2217
100
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 CKI KWF Bot
|
77af58432d |
Merge: sctp: validate cached peer INIT chunk in cookie
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8595 JIRA: https://redhat.atlassian.net/browse/RHEL-190190 CVE: CVE-2026-53246 Patch 1 is CVE fix, and patch 2 is a similar fix for cookie. Signed-off-by: Xin Long <lxin@redhat.com> Approved-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
4355d48190 |
Merge: CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8577
JIRA: https://redhat.atlassian.net/browse/RHEL-234286
CVE: CVE-2026-64564
Backported from tree(s): linux
```
sctp: don't free the ASCONF's own transport in DEL-IP processing
sctp_process_asconf() caches the transport the ASCONF chunk is processed
against in asconf->transport (== chunk->transport, set once in sctp_rcv()).
For an ASCONF located through its Address Parameter by
__sctp_rcv_asconf_lookup(), that cached transport corresponds to the
Address Parameter, which need not be the packet's source address.
sctp_process_asconf_param() rejects a DEL-IP for the packet source address
(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.
A single ASCONF can therefore carry, in order:
[Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]
where L differs from the source. The DEL-IP for L passes the D8 check and
calls sctp_assoc_rm_peer() on the transport that asconf->transport still
points at, freeing it (RCU-deferred). The following wildcard DEL-IP then
reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and
sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed
transport (->ipaddr, ->state) and plants the dangling pointer into
asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping
only the pointer that is no longer on the list, removes every real
transport, leaving the association with a transport_count of 0 and
primary_path/active_path pointing at freed memory.
Reject a DEL-IP that targets the transport the ASCONF is being processed
against, mirroring the existing source-address guard, so the wildcard
branch can never reuse a freed transport.
Fixes:
|
||
|
CKI KWF Bot
|
b38e3d3909 |
Merge: CVE-2026-64277: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8551
JIRA: https://redhat.atlassian.net/browse/RHEL-231453
CVE: CVE-2026-64277
Backported from tree(s): linux
```
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
rmi_f3a_initialize() takes the GPIO count from the device query register
(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).
rmi_f3a_map_gpios() then allocates gpio_key_map with
min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f3a_attention() iterates the full gpio_count and dereferences
gpio_key_map[i], and input->keycodemax is set to the full gpio_count
while input->keycode points at the 6-entry allocation.
A device that reports gpio_count > 6 therefore causes an out-of-bounds
read of gpio_key_map[] on every attention interrupt, and out-of-bounds
accesses through the input core's default keymap ioctls: EVIOCGKEYCODE
reads past the buffer (leaking adjacent slab memory to user space) and
EVIOCSKEYCODE writes a caller-controlled value past it, for any process
able to open the evdev node, since input_default_getkeycode() and
input_default_setkeycode() only bound the index against keycodemax.
Size the keymap for the full gpio_count. The mapping loop is unchanged:
it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)
entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)
and are skipped when reporting.
Fixes:
|
||
|
CKI KWF Bot
|
3bfe70209c |
Merge: CVE-2026-64276: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8534
JIRA: https://redhat.atlassian.net/browse/RHEL-230265
CVE: CVE-2026-64276
Backported from tree(s): linux
```
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
rmi_f30_map_gpios() allocates gpioled_key_map with
min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f30_attention() iterates the full f30->gpioled_count (device query
register, range 0..31) and dereferences gpioled_key_map[i], and
input->keycodemax is set to the full gpioled_count while input->keycode
points at the 6-entry allocation.
A device that reports gpioled_count > 6 with GPIO support enabled
therefore causes an out-of-bounds read on the attention interrupt and
out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,
which bound the index only against keycodemax. This is the same defect
as the F3A handler, which was copied from F30.
Size the keymap for the full gpioled_count; the mapping loop still
assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.
Fixes:
|
||
|
CKI KWF Bot
|
9f5db116c9 |
Merge: sctp: prevent peer transport count overflow [9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8426
JIRA: https://redhat.atlassian.net/browse/RHEL-214461
Backported from tree(s): net
```
sctp: prevent peer transport count overflow
sctp_assoc_add_peer() increments the association's 16-bit transport_count
for every new unique peer. Adding the 65,536th transport wraps the count to
zero.
SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,
then copies one sockaddr_storage for every entry in transport_addr_list.
After the wrap, a diagnostic dump reserves an empty payload and writes
8 MiB of peer addresses past the skb tail.
Reject a new unique peer when transport_count has reached U16_MAX. Perform
the check after the existing-peer lookup so a duplicate address continues
to return its existing transport at the limit.
Fixes:
|
||
|
CKI KWF Bot
|
88c2540415 |
Merge: sctp: hold socket lock when dumping endpoints in sctp_diag
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8384 JIRA: https://redhat.atlassian.net/browse/RHEL-212388 Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8060 7d8297e26b4e ("sctp: hold socket lock when dumping endpoints in sctp_diag") Signed-off-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Xin Long <lxin@redhat.com> Approved-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f401f210c3 |
Merge: CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8270
JIRA: https://redhat.atlassian.net/browse/RHEL-188202
CVE: CVE-2026-52924
Backported from tree(s): linux
```
sctp: purge outqueue on stale COOKIE-ECHO handling
sctp_stream_update() is only invoked when the association is moved into
COOKIE_WAIT during association setup/reconfiguration. In this path, the
outbound stream scheduler state (stream->out_curr) is expected to be
clean, since no user data should have been transmitted yet unless the
state machine has already partially progressed.
However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a
Stale Cookie ERROR is received, the association is rolled back from
COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already
have been queued and even bundled with the COOKIE-ECHO chunk.
During the rollback, sctp_stream_update() frees the old stream table
and installs a new one, but it does not invalidate stream->out_curr.
As a result, out_curr may still point to a freed sctp_stream_out
entry from the previous stream state.
Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on
stream->out_curr->ext, which can lead to use-after-free once the old
stream state has been released via sctp_stream_free().
This results in crashes such as (reported by Yuqi):
BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140
Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312
CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted
7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)
sctp_sched_fcfs_dequeue+0x13a/0x140
sctp_outq_flush+0x1603/0x33e0
sctp_do_sm+0x31c9/0x5d30
sctp_assoc_bh_rcv+0x392/0x6f0
sctp_inq_push+0x1db/0x270
sctp_rcv+0x138d/0x3c10
Fix this by fully purging the association outqueue when handling the
Stale Cookie case. This ensures all pending transmit and retransmit
state is dropped, and any scheduler cached pointers are invalidated,
making it safe to rebuild stream state during COOKIE_WAIT restart.
Updating only stream->out_curr would be insufficient, since queued
and retransmittable data would still reference the old stream state and
trigger later use-after-free in dequeue paths.
Fixes:
|
||
|
CKI KWF Bot
|
43933b233c |
Merge: : Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8243 JIRA: https://redhat.atlassian.net/browse/RHEL-182345 ``` CVE: CVE-2026-53266 Backported from tree(s): linux netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit |
||
|
CKI KWF Bot
|
bf9195a2f1 |
Merge: srv6: stable backport for 9.9 phase 2
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7989 JIRA: https://redhat.atlassian.net/browse/RHEL-152701 ``` commit 06413793526251870e20402c39930804f14d59c0 Author: Minhong He <heminhong@kylinos.cn> Date: Mon Mar 16 15:33:01 2026 +0800 ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL pointer dereferences. Fixes: |
||
|
CKI KWF Bot
|
d36d81f913 |
[redhat] kernel-5.14.0-740.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
2fca06323f |
Merge: CVE-2026-43493 kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests [rhel-9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8638 JIRA: https://redhat.atlassian.net/browse/RHEL-226701 CVE: CVE-2026-43493 commit 915b692e6cb723aac658c25eb82c58fd81235110 Author: Herbert Xu <herbert@gondor.apana.org.au> Date: Thu Apr 16 17:00:50 2026 +0800 crypto: pcrypt - Fix handling of MAY_BACKLOG requests Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: Vladislav Dronov <vdronov@redhat.com> Approved-by: Thomas Huth <thuth@redhat.com> Approved-by: Lenny Szubowicz <lszubowi@redhat.com> Approved-by: Bruno Meneguele <bmeneg@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
115456b844 |
Merge: mm/memfd: Fix CVE-2026-63952
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8590 JIRA: https://redhat.atlassian.net/browse/RHEL-228526 CVE: CVE-2026-63952 Backport fix for CVE-2026-63952. The first commit is a spelling fix to make the fix apply cleanly. Signed-off-by: Luiz Capitulino <luizcap@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Herton R. Krzesinski <herton@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
0f8e050710 |
Merge: perf: Intel NVL, DMR and WCL support plus ACR and PEBS update
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8584 JIRA: https://redhat.atlassian.net/browse/RHEL-45125 JIRA: https://redhat.atlassian.net/browse/RHEL-115121 JIRA: https://redhat.atlassian.net/browse/RHEL-115123 JIRA: https://redhat.atlassian.net/browse/RHEL-115125 JIRA: https://redhat.atlassian.net/browse/RHEL-117336 JIRA: https://redhat.atlassian.net/browse/RHEL-117338 JIRA: https://redhat.atlassian.net/browse/RHEL-120358 JIRA: https://redhat.atlassian.net/browse/RHEL-95669 This batch covers multiple issues, however logically tied-together. * cstate support for Intel NVL, DMR and WCL * uncore support for Intel NVL and DMR * many fixes and pre-requisities for the uncore and core support * core PMU support for Intel NVL and DMR * ACR functionality which the NVL and DMR core take advantage of * Architectural PEBS (by Anubhav Shelat) Signed-off-by: Michael Petlan <mpetlan@redhat.com> Signed-off-by: Anubhav Shelat <ashelat@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: ashelat <ashelat@redhat.com> Approved-by: tallison1 <tallison@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
7f54b767c3 |
[redhat] kernel-5.14.0-739.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
c31260fe4e |
Merge: mm/vmscan: fix hard LOCKUP in function isolate_lru_folios
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8663 JIRA: https://issues.redhat.com/browse/RHEL-153668 Tested: sanity I've run multiple mm tests but nothing specific for this issue. Customer hit it once and didn't give further information. It is a fairly safe patch though that can prevent these from happening on other customers. Signed-off-by: Aristeu Rozanski <arozansk@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Jay Shin <jaeshin@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
ff6a06e667 |
Merge: CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8619 JIRA: https://redhat.atlassian.net/browse/RHEL-227838 CVE: CVE-2026-64560 CVE: CVE-2026-64370 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8619 By incorporating a number of posix-timers patches from the series in merge commit 9a7b0158aea7 ("Merge tag 'posix-timers-2024-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks into timers/core") and a few extra ones, the merge conflicts with the posix_cpu_timer_set() and posix_cpu_timer_rearm() functions can be eliminated. However, merge conflicts still exist for posix_cpu_timer_del() and kernel/exit.c as resolving them will require pulling in a lot more patches. This MR also includes another minor CVE-2026-64370 fix in the same posix timers code base. Signed-off-by: Waiman Long <longman@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
fc8fafb0d4 |
Merge: CVE-2026-64557: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8596 JIRA: https://redhat.atlassian.net/browse/RHEL-231355 CVE: CVE-2026-64557 * 9707a015fe8f3ba8ec7c270f3b2b8efb38823d6b Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister [linux] * 6fef032af0092ed5ccb767239a9ac1bc38c08a40 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() [linux] Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-08-10 20:44 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: David Marlin <dmarlin@redhat.com> Approved-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
809b9b6116 |
Merge: CVE-2026-52991: sched/psi: fix race between file release and pressure write
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8578 JIRA: https://redhat.atlassian.net/browse/RHEL-232556 CVE: CVE-2026-52991 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8578 This MR contains the following 3 commits. 1) commit a5b98009f16d ("sched/psi: fix race between file release and pressure write") 2) commit fadeedd7cfc5 ("sched/psi: Create the psimon kthread outside of cgroup_mutex") 3) commit 94a4acfec146 ("cgroup/psi: Set of->priv to NULL upon file release") Commit fadeedd7cfc5 relies on the last patch to correctly detect if a file release has happened after releasing and re-acquiring the lock. Signed-off-by: Waiman Long <longman@redhat.com> Approved-by: Phil Auld <pauld@redhat.com> Approved-by: Herton R. Krzesinski <herton@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e020afc405 |
Merge: CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8561
JIRA: https://redhat.atlassian.net/browse/RHEL-232106
CVE: CVE-2026-64191
Backported from tree(s): linux
```
i2c: stub: Reject I2C block transfers with invalid length
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
as the transfer length. The existing check only clamps it to avoid
overrunning the chip->words[256] register array, but does not validate
it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union
i2c_smbus_data.block buffer (34 bytes total). The driver is a
development/test tool (CONFIG_I2C_STUB=m, not built by default)
that must be loaded with a chip_addr= parameter.
A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl
with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing
stub_xfer() to read or write past the end of the union
i2c_smbus_data.block buffer:
BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)
Read of size 1 at addr ffff88800abcfd92 by task exploit/81
Call Trace:
<TASK>
stub_xfer (drivers/i2c/i2c-stub.c:223)
__i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)
i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)
i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)
i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)
__x64_sys_ioctl (fs/ioctl.c:583)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
</TASK>
The bug exists because i2c-stub implements .smbus_xfer directly,
bypassing the I2C_SMBUS_BLOCK_MAX validation in
i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same
function correctly validates against I2C_SMBUS_BLOCK_MAX, but the
I2C_SMBUS_I2C_BLOCK_DATA case does not.
Fix by rejecting transfers with data->block[0] == 0 or
data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with
both the I2C_SMBUS_BLOCK_DATA case in the same function and the
I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().
Fixes:
|
||
|
CKI KWF Bot
|
6b032e4be5 |
Merge: CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8533
JIRA: https://redhat.atlassian.net/browse/RHEL-230091
CVE: CVE-2026-64048
Backported from tree(s): linux
```
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is
reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt()
populates V2 entries starting at index 1, so when no V1 device is
selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] ==
NULL and ism_chid[0] == 0.
smc_v2_determine_accepted_chid() then matches the peer's CHID against
the array starting from index 0 using the CHID alone. A malicious
peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches
the empty slot, ini->ism_selected becomes 0, and the subsequent
ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at
offsetof(struct smcd_dev, lgr_lock) == 0x68:
BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0
Write of size 4 at addr 0000000000000068 by task exploit/144
Call Trace:
_raw_spin_lock_bh
smc_conn_create (net/smc/smc_core.c:1997)
__smc_connect (net/smc/af_smc.c:1447)
smc_connect (net/smc/af_smc.c:1720)
__sys_connect
__x64_sys_connect
do_syscall_64
Require ism_dev[i] to be non-NULL before accepting a CHID match.
Fixes:
|
||
|
CKI KWF Bot
|
baea293d47 |
Merge: [RHEL-9.9] Recent upstream fixes for IOMMU subsystem
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8411 JIRA: https://redhat.atlassian.net/browse/RHEL-213932 Upstream-Status: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Recent upstream fixes for IOMMU subsystem CVE: CVE-2026-43220 CVE: CVE-2026-43253 CVE: CVE-2026-64289 CVE: CVE-2026-53164 CVE: CVE-2026-64290 CVE: CVE-2026-64291 CVE: CVE-2026-53283 CVE: CVE-2026-64293 CVE: CVE-2026-53053 CVE: CVE-2026-53372 CVE: CVE-2025-71122 CVE: CVE-2026-68324 CVE: CVE-2026-68325 CVE: CVE-2026-68329 CVE: CVE-2026-64591 Signed-off-by: Eder Zulian <ezulian@redhat.com> Approved-by: Jerry Snitselaar <jsnitsel@redhat.com> Approved-by: Jocelyn Falempe <jfalempe@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
0483df2e89 |
Merge: Recent upstream fixes for DMA Engine drivers
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8410 JIRA: https://redhat.atlassian.net/browse/RHEL-213921 Upstream-Status: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Recent upstream fixes for DMA engine drivers Signed-off-by: Eder Zulian <ezulian@redhat.com> Approved-by: Eric Chanudet <echanude@redhat.com> Approved-by: Jerry Snitselaar <jsnitsel@redhat.com> Approved-by: jbrnak <jbrnak@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e4bf03db6c |
Merge: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8376
JIRA: https://redhat.atlassian.net/browse/RHEL-178418
Upstream Status: net.git
CVE: CVE-2026-43501
Conflicts:\
- Minor context difference as c9s lacks upstream commit 5ee6ad1dcae8 ("ipv6:
exthdrs: use swap() instead of open coding it").
commit 9e6bf146b55999a095bb14f73a843942456d1adc
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue Apr 21 15:16:33 2026 +0200
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back. The
recompressed header can be larger than the received one when the swap
reduces the common-prefix length the segments share with daddr (CmprI=0,
CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes).
pskb_expand_head() was gated on segments_left == 0, so on earlier
segments the push consumed unchecked headroom. Once skb_push() leaves
fewer than skb->mac_len bytes in front of data,
skb_mac_header_rebuild()'s call to:
skb_set_mac_header(skb, -skb->mac_len);
will store (data - head) - mac_len into the u16 mac_header field, which
wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB
past skb->head.
A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two
segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one
pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.
Fix this by expanding the head whenever the remaining room is less than
the push size plus mac_len, and request that much extra so the rebuilt
MAC header fits afterwards.
Fixes:
|
||
|
CKI KWF Bot
|
f3f328cc24 |
[redhat] kernel-5.14.0-738.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
8a24d07c4a |
Merge: smartpqi updates
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8585 JIRA: https://redhat.atlassian.net/browse/RHEL-224339 [rhkl_cover_letter_rel9.9_jira_rhel-224339](/uploads/56afc736431bca93f25dc1e6446899b8/rhkl_cover_letter_rel9.9_jira_rhel-224339) Signed-off-by: Don Brace <dbrace@redhat.com> Approved-by: djeffery1 <djeffery@redhat.com> Approved-by: Laurence Oberman <loberman@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
b40e9f2a5f |
Merge: CVE-2026-63886: scsi: target: iscsi: Validate CHAP_R length before base64 decode
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8555 JIRA: https://redhat.atlassian.net/browse/RHEL-231655 CVE: CVE-2026-63886 * 85db7391310b1304d2dc8ae3b0b12105a9567147 scsi: target: iscsi: Validate CHAP_R length before base64 decode [linux] * 7e161211f1dd5288b4ea802b30e70ef919ebc3da scsi: target: Fix hexadecimal CHAP_I handling [linux] Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-08-06 00:31 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Laurence Oberman <loberman@redhat.com> Approved-by: djeffery1 <djeffery@redhat.com> Approved-by: Chris Leech <cleech@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
dc12c63bbf |
Merge: [RHEL - 9.9]: select intel tpmi/plr unbind fixes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8470 JIRA: https://redhat.atlassian.net/browse/RHEL-212707 RHEL is missing the following upstream commits: 57c347a2e247 platform/x86: intel: Add notifiers support 14473e8c4e97 platform/x86/intel/tpmi/plr: Prevent fault during unbind Signed-off-by: Dennis Chen <dechen@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
dcd7dc0dee |
Merge: [RHEL 9.9]: x86/fpu: Ensure XFD state on signal delivery
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8465 JIRA: https://redhat.atlassian.net/browse/RHEL-212652 commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9 Author: Chang S. Bae <chang.seok.bae@intel.com> Date: Mon Jun 9 17:16:59 2025 -0700 x86/fpu: Ensure XFD state on signal delivery Sean reported [1] the following splat when running KVM tests: WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70 Call Trace: <TASK> fpu__clear_user_states+0x9c/0x100 arch_do_signal_or_restart+0x142/0x210 exit_to_user_mode_loop+0x55/0x100 do_syscall_64+0x205/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Chao further identified [2] a reproducible scenario involving signal delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR. When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption. Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature. This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible. [ dhansen: minor changelog munging ] Closes: https://lore.kernel.org/lkml/aDCo_SczQOUaB2rS@google.com [1] Fixes: 672365477ae8a ("x86/fpu: Update XFD state where required") Reported-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Reviewed-by: Chao Gao <chao.gao@intel.com> Tested-by: Chao Gao <chao.gao@intel.com> Link: https://lore.kernel.org/all/aDWbctO%2FRfTGiCg3@intel.com [2] Cc:stable@vger.kernel.org Link: https://patch.msgid.link/20250610001700.4097-1-chang.seok.bae%40intel.com (cherry picked from commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9) Assisted-by: Patchpal Signed-off-by: Dennis Chen <dechen@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
a1ea784b42 |
Merge: [RHEL 9.9]: platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8464 JIRA: https://redhat.atlassian.net/browse/RHEL-212719 Upstream status: v7.1 RHEL is missing commit 348ccc754d89 ("platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery"). Conflicts: - drivers/platform/x86/intel/vsec.c::intel_vsec_pci_probe(): Remove const qualifiers to avoid 9577c74c96f8 ("platform/x86/intel/vsec: Make driver_data info const") Assisted-by: Patchpal Signed-off-by: Dennis Chen <dechen@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
86ddd0217f |
Merge: ALSA - update drivers for 9.9 - upstream 7.1.5 (stable)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8435 JIRA: https://issues.redhat.com/browse/RHEL-193254 This upstream patchset updates the ALSA driver code to upstream stable 7.1.5 kernel. Omitted-fix: dd1bfaf9413e9c8a0fcfb45dcb735c6768a45251 # see commit - this revert is for 7.2+ kernel code Omitted-fix: 99c159279c6dfa2c4867c7f76875f58263f8f43b # used hash 225d70b8074502acee3943bf0c2e839e867cd38c for backport - already in RHEL kernel Signed-off-by: Jaroslav Kysela <jkysela@redhat.com> Approved-by: Krzysztof Pawlinski <kpawlins@redhat.com> Approved-by: Desnes Nunes <desnesn@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
d4b1ffb1fe |
Merge: KVM: Revisit kvm_arch_set_irq_inatomic optimization
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8403 JIRA: https://redhat.atlassian.net/browse/RHEL-136457 commits ``` d41993f71385 ("KVM: s390: get rid of gmap_translate()") c9a568838086 ("KVM: s390: Add map/unmap ioctl and clean mappings post-guest") 1e95e3bc6b05 ("KVM: s390: Enable adapter_indicators_set to use mapped pages") a868b30492c5 ("KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject") 9972befc3e34 ("KVM: s390: Fall back to short-term pinning in MAP ioctl" cherry picked from kvms390/linux.git) ``` Conflicts: Target code does not have kzalloc_obj(), replaced usages with kzalloc(). Target code does not have ind_gaddr and summary_gaddr, replace usages with ind_addr and summary_addr. interrupt.c: Manual merge of kvm_set_routing_entry() Signed-off-by: Christoph Schlameuss <cschlame@redhat.com> --- v7: - rebased with conflict resolution in interrupt.c v6: - rebased - moved spin_unlock_irqrestore() in __deliver_service() to correct patch v5: - added final commit from maintainer tree v4: - TBD commit is about to be picked by maintainers, will adjust the hash as soon as it is in a maintainer tree Approved-by: Cornelia Huck <cohuck@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
789b1c9c2d |
Merge: netfilter: nfnetlink_queue: optimize verdict lookup with hash table
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8357 JIRA: https://redhat.atlassian.net/browse/RHEL-150728 The current implementation uses a linear list to find queued packets by ID when processing verdicts from userspace. With large queue depths and out-of-order verdicting, this O(n) lookup becomes a significant bottleneck, causing userspace verdict processing to dominate CPU time. Replace the linear search with a hash table for O(1) average-case packet lookup by ID. A global rhashtable spanning all network namespaces attributes hash bucket memory to kernel but is subject to fixed upper bound. Also includes the relevant selftest changes. Most changes to the selftests here are dependencies. SCTP and UDPGRO test not backported, SCTP was very flaky and would need more followups, UDPGRO test would fail because we lack the relevant nfqueue fixes. Omitted-fix: 4e97d521c2be094718c4c5c7c4f785e8972b4af0 ("selftests: netfilter: nft_queue.sh: sctp coverage") Unrelated to this feature Omitted-fix: 59ecffa3995e70a675beeb870f0b3a28470428de ("selftests: netfilter: nft_queue.sh: add udp fraglist gro test case") ) Unrelated to this feature and would need a lot more backporting work. Signed-off-by: Florian Westphal <fwestpha@redhat.com> Approved-by: Phil Sutter <psutter@redhat.com> Approved-by: Eric Garver <egarver@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5b1e3a510f |
Merge: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8340 JIRA: https://redhat.atlassian.net/browse/RHEL-186591 This issue is specific to kernel-rt and has already been addressed in RHEL-10 with recent updates. As stated in the commit description: On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute rt6_make_pcpu_route() and successfully install a pcpu_rt entry. When the first task resumes execution, its cmpxchg() in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding mdelay() after rt6_get_pcpu_route(). Using preempt_disable/enable is not appropriate here because ip6_rt_pcpu_alloc() may sleep. Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT: free our allocation and return the existing pcpu_rt installed by another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT kernels where such races should not occur. In order to fix this problem, backport the followin upstream commit: 1adaea51c61b ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT Signed-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: Wander Lairson Costa <wander@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
3df9cdee80 |
Merge: CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8278
JIRA: https://redhat.atlassian.net/browse/RHEL-188519
CVE: CVE-2026-53000
Backported from tree(s): linux
```
netfilter: nat: use kfree_rcu to release ops
Florian Westphal says:
"Historically this is not an issue, even for normal base hooks: the data
path doesn't use the original nf_hook_ops that are used to register the
callbacks.
However, in v5.14 I added the ability to dump the active netfilter
hooks from userspace.
This code will peek back into the nf_hook_ops that are available
at the tail of the pointer-array blob used by the datapath.
The nat hooks are special, because they are called indirectly from
the central nat dispatcher hook. They are currently invisible to
the nfnl hook dump subsystem though.
But once that changes the nat ops structures have to be deferred too."
Update nf_nat_register_fn() to deal with partial exposition of the hooks
from error path which can be also an issue for nfnetlink_hook.
Fixes:
|
||
|
CKI KWF Bot
|
1af6f88517 |
Merge: tcp: support for TCP_AO
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8057 JIRA: https://redhat.atlassian.net/browse/RHEL-142637 CVE: CVE-2025-39852 CVE: CVE-2026-43384 CVE: CVE-2025-39950 CVE: CVE-2024-43887 CVE: CVE-2024-40985 CVE: CVE-2024-27394 Upstream Status: all mainline in net.git, except Kconfig and RPM specfile Omitted-fix: 3f36781e57b3 ("selftests/net: Add mixed select()+polling mode to TCP-AO tests"): a fix for flaky test on slow machines, whose backport on c9s is not trivial Omitted-fix: 9d58d14e3a18 ("crypto: api - Fold __crypto_alloc_tfmgfp() into __crypto_alloc_tfm()"): crypto_tfm rework not needed Omitted-fix: 0200de9d75b1 ("crypto: api - Fold crypto_alloc_tfmmem() into crypto_create_tfm_node()"): crypto_tfm rework not needed Omitted-fix: 3065170bfc7f ("crypto: api - Remove per-tfm refcount"): crypto_tfm rework not needed Omitted-fix: e1a9d3cc1182 ("tcp: initialize standalone TCP-AO response padding"): missing TCP NOP to pad TCP_AO option. Will follow-up with another MR Tested: - successful build with and without CONFIG_TCP_AO - ran kselftests in net/tcp_ao, all PASS Depends:!7999 patch 1-10 add support for cmac/hmac/hash cloning patch 11-12 are fixes for cmac/hmac/hash cloning patch 13-21 are needed to reduce conflicts patch 22-44 backport TCP_AO functionality from upstream patch 45-72 contain fixes+follow-ups patch 73-103 contain kselftests + fixes found while developing kselftests patch 104-108 contain later fixes patch 109 enable TCP_AO in c9s config patch 110 adds tcp_ao kselftests to kernel-selftests-internal RPM Signed-off-by: Davide Caratti <dcaratti@redhat.com> Approved-by: Jan Stancek <jstancek@redhat.com> Approved-by: Paolo Abeni <pabeni@redhat.com> Approved-by: Thomas Huth <thuth@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
54ebc1655b |
Merge: iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8041 JIRA: https://issues.redhat.com/browse/RHEL-155154 * iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 Signed-off-by: Petr Oros <poros@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Michal Schmidt <mschmidt@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
7628f49232 |
[redhat] kernel-5.14.0-737.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
f7d0c7a526 |
Merge: CIFS: fix broken directory listing against old SMB1 servers [rhel-9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8589 - fix broken directory listing against old SMB1 servers JIRA: https://redhat.atlassian.net/browse/RHEL-222675 Signed-off-by: Paulo Alcantara <paalcant@redhat.com> Approved-by: David Howells <dhowells@redhat.com> Approved-by: Scott Mayhew <smayhew@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
034a36f190 |
Merge: vhost: reset the vring metadata cache on vring reconfiguration [9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8475
JIRA: https://redhat.atlassian.net/browse/RHEL-224537
Backported from tree(s): linux
```
vhost: reset the vring metadata cache on vring reconfiguration
vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring
metadata region, and iotlb_access_ok() returns early on a cache hit,
taking the hit as proof that the region has already been validated:
if (vhost_vq_meta_fetch(vq, addr, len, type))
return true;
The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on
device IOTLB (re)initialisation and on vq reset, but not when
VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when
VHOST_SET_VRING_NUM changes the region sizes.
With a device IOTLB attached both ioctls are accepted while the vq is
live, and neither validates the addresses at ioctl time: vq_access_ok()
and vq_log_used_access_ok() return true early because the addresses are
GIOVAs, deferring validation to prefetch time. Once the cache has been
populated that deferred validation no longer runs -- vq_meta_prefetch()
hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps
translating through the old mapping as
map->addr + addr - map->start
for an address the mapping no longer covers. vhost_copy_to_user() and
vhost_copy_from_user() consume the result with __copy_to_user() and
__copy_from_user(), which do not check it either, so a subsequent used
ring update or descriptor fetch accesses memory outside the region the
IOTLB actually maps.
Reset the metadata cache whenever the vring is reconfigured, so the new
addresses are pushed back through iotlb_access_ok()'s slow path.
Fixes:
|
||
|
CKI KWF Bot
|
4abb008e5d |
Merge: Select fixes for thermal/intel
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8460 JIRA: https://issues.redhat.com/browse/RHEL-212721 RHEL9 is missing the following upstream commits: 1fac72873549 thermal: intel: int340x: Fix potential shift overflow in ptc_mmio_write() b91d287fa7a1 thermal: intel: Fix dangling resources on thermal_throttle_online() failure Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
9dbe02b82e |
Merge: bnxt_en: Fix NULL pointer dereference
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8287
JIRA: https://redhat.atlassian.net/browse/RHEL-185084
Backported from tree(s): linux
```
bnxt_en: Fix NULL pointer dereference
PCIe errors detected by a Root Port or Downstream Port cause error
recovery services to run on all subordinate devices regardless of
administrative state.
The .error_detected() callback, bnxt_io_error_detected(), disables
and synchronizes IRQs via bnxt_disable_int_sync(), which calls
bnxt_cp_num_to_irq_num() to map completion rings to IRQs using
bp->bnapi.
Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe
error recovery on a closed NIC can dereference a NULL pointer.
Check if bp->bnapi is NULL before disabling and synchronizing IRQs.
Fixes:
|
||
|
CKI KWF Bot
|
25d5ed9c78 |
[redhat] kernel-5.14.0-736.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
7b3b46081a |
Merge: SELinux TCP/MPTCP connect check bypass via TCP Fast Open
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8474 JIRA: https://redhat.atlassian.net/browse/RHEL-222801 Backported from tree(s): linux ``` selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update its socket_sendmsg() hook to call selinux_socket_connect() when MSG_FASTOPEN is passed. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/ Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/ Reported-by: Bryam Vargas <hexlabsecurity@proton.me> Reported-by: Matthieu Buffet <matthieu@buffet.re> Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> Tested-by: Bryam Vargas <hexlabsecurity@proton.me> Signed-off-by: Paul Moore <paul@paul-moore.com> (cherry picked from commit 44c74d27d1b9aaa99fa8a83640c1223575262b80) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-08-05 13:33 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Ondrej Mosnáček <omosnacek@gmail.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
019e7f4a24 |
Merge: i2c: core: fix adapter deregistration race
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8472
JIRA: https://issues.redhat.com/browse/RHEL-222902
CVE: CVE-2026-64279
commit b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f
Author: Johan Hovold <johan@kernel.org>
Date: Mon May 11 16:37:13 2026 +0200
i2c: core: fix adapter deregistration race
Adapters can be looked up by their id using i2c_get_adapter() which
takes a reference to the embedded struct device.
Remove the adapter from the IDR before tearing it down during
deregistration (and on registration failure) to make sure its resources
are not accessed after having been freed (e.g. the device name).
Fixes:
|
||
|
CKI KWF Bot
|
f8efac2116 |
Merge: ARM64: Mitigate TLBI errata on various CPUs
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8462 JIRA: https://redhat.atlassian.net/browse/RHEL-183626 CVE: CVE-2025-10263 Mitigate TLBI errata on: Azure Cobalt 100 Nvidia Olympus Cortex A76, A76AE Cortex A77 Cortex A78, A78AE, A78C Cortex A710 Cortex X1, X1C, X2, X3, X4 Cortex X925 Cortex N1, N2 Cortex V1, V2, V3, V3AE C1-Premium, C1-Ultra Signed-off-by: Mark Salter <msalter@redhat.com> Approved-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: Steve Dunnagan <sdunnaga@redhat.com> Approved-by: Jennifer Berringer <jberring@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e0c9ff6cde |
Merge: platform/x86/amd/hsmp: Clamp ioctl/send_message indices (Spectre v1)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8461 JIRA: https://issues.redhat.com/browse/RHEL-217011 commit d20457b46eca76b9bb716dd31af591cad21607b5 Author: Muralidhara M K <muralidhara.mk@amd.com> Date: Fri Jun 12 09:56:08 2026 +0530 platform/x86/amd/hsmp: Clamp ioctl/send_message indices (Spectre v1) Although validate_message() checks msg_id, a mispredicted branch can still allow speculative indexing into hsmp_msg_desc_table[]. Clamp msg.msg_id with array_index_nospec() at entry to hsmp_ioctl_msg() so downstream dereferences (including via is_get_msg() and hsmp_send_message()) see a bounded index. Similarly, hsmp_send_message() bounds-checks msg->sock_ind before indexing hsmp_pdev.sock[], but a mispredicted branch can still speculatively use the raw index (Spectre v1, CVE-2017-5753). Apply array_index_nospec() after the check so every caller that reaches hsmp_pdev.sock[] through this helper sees a clamped socket index—including hsmp_ioctl_msg() and any other path that hands a user-derived struct hsmp_message to hsmp_send_message(). Reviewed-by: Muthusamy Ramalingam <muthusamy.ramalingam@amd.com> Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com> Link: https://patch.msgid.link/20260612042610.1629037-7-muralidhara.mk@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
bc375e5026 |
Merge: pinctrl-amd: Don't clear S4 wake bits at probe
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8441 JIRA: https://issues.redhat.com/browse/RHEL-211144 commit ffe8a0c6b55285ceaf2f42fc20c3a0594d14f1e9 Author: Mario Limonciello <mario.limonciello@amd.com> Date: Mon Jul 20 11:28:44 2026 -0500 pinctrl-amd: Don't clear S4 wake bits at probe commit 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") introduced a regression where Wake-on-LAN no longer works after suspend or shutdown on some AMD platforms. Firmware-programmed S4 wake bits for devices like PCIe NICs using PCI PME are cleared at probe, but nothing restores them. Unlike S0i3/S3 wake sources that use enable_irq_wake() -> amd_gpio_irq_set_wake(), PCIe PME does not use GPIO IRQ infrastructure and relies on firmware configuration. The original intent of commit 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") was to clear spurious wake bits left by firmware to prevent unwanted wakeups. However, S4 wake bits are used for hardware-level wake sources like WoL that bypass the kernel's IRQ wake API. Fix by preserving S4 wake bits at probe and only clearing S0i3/S3 bits: - Firmware-configured S4 wake sources (WoL) continue working - Kernel maintains control of S3/S0i3 wake policy via set_wake() - S3-only wake sources work correctly per commit f31f33dbb3ba ("pinctrl: amd: Take suspend type into consideration which pins are non-wake") The trade-off is that firmware-programmed spurious S4 wake bits remain set, but this is less problematic than breaking WoL. Fixes: 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Linus Walleij <linusw@kernel.org> Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f61540d679 |
Merge: Select fs/resctrl fixes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8440 JIRA: https://issues.redhat.com/browse/RHEL-216442 A number of fixes have landed upstream that should be included in RHEL. Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Approved-by: Gavin Shan <gshan@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
56bf8d01e8 |
Merge: KVM: kvm fixes for 2026-07-21
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8407 KVM: kvm fixes for 2026-07-21 JIRA: https://redhat.atlassian.net/browse/RHEL-211279 JIRA: https://redhat.atlassian.net/browse/RHEL-213339 CVE: CVE-2025-40026 CVE: CVE-2026-63807 Commits: ``` KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level KVM: nVMX: Hide shadow VMCS right after VMCLEAR KVM: x86: Check for invalid/obsolete root *after* making MMU pages available KVM: nVMX: Add helper to put (unmap) vmcs12 pages KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O ``` Signed-off-by: Aidan Wallace <awallace@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Approved-by: Peter Xu <peterx@redhat.com> Approved-by: Jay Shin <jaeshin@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
9a7ab8ac04 |
Merge: ARM CSPMU patches in preparation for Vera platforms
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8386 JIRA: https://issues.redhat.com/browse/RHEL-121676 Backport preparatory patch series for ARM CoreSight PMU (CSPMU) to support NVIDIA T410 Performance Monitoring Unit on Vera platforms. Signed-off-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: Mark Salter <msalter@redhat.com> Approved-by: Mark Langsdorf <mlangsdo@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
b16a02ffb5 |
Merge: fixup! Merge: s390/entry: Scrub r12 register on kernel entry
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8331 JIRA: https://redhat.atlassian.net/browse/RHEL-191803 commit 0738d395aab8fae3b5a3ad3fc640630c91693c27 Author: Vasily Gorbik gor@linux.ibm.com Date: Thu Mar 26 19:50:14 2026 +0100 s390/entry: Scrub r12 register on kernel entry Before commit f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP"), all entry handlers loaded r12 with the current task pointer (lg %r12,__LC_CURRENT) for use by the BPENTER/BPEXIT macros. That commit removed TIF_ISOLATE_BP, dropping both the branch prediction macros and the r12 load, but did not add r12 to the register clearing sequence. Add the missing xgr %r12,%r12 to make the register scrub consistent across all entry points. Fixes: f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP") Cc: stable@kernel.org Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Jan Polensky <jpolensk@redhat.com> Approved-by: Daniel Horak <dhorak@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
550013cad9 |
Merge: rtc: rx8111: Enable driver for Epson RX8111
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8317 Enable the Epson RX8111 RTC driver JIRA: https://issues.redhat.com/browse/RHEL-184760 Performed a basic test to see that the driver was loaded on a Siemens BX-35A device. Signed-off-by: Nirmala Dalvi <ndalvi@redhat.com> Approved-by: Jennifer Berringer <jberring@redhat.com> Approved-by: Rupinderjit Singh <rusingh@redhat.com> Approved-by: mkopelev <mkopelev@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f2944db641 |
Merge: CVE-2026-52923 kernel: ipc: limit next_id allocation to the valid ID range [rhel-9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8301 JIRA: https://redhat.atlassian.net/browse/RHEL-188213 CVE: CVE-2026-52923 commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 Author: Linpu Yu <linpu5433@gmail.com> Date: Sun May 10 13:43:30 2026 +0800 ipc: limit next_id allocation to the valid ID range Signed-off-by: Rafael Aquini <raquini@redhat.com> Approved-by: Luiz Capitulino <luizcap@redhat.com> Approved-by: Phil Auld <pauld@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
c2c949a295 |
[redhat] kernel-5.14.0-735.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
21a60185db |
Merge: CVE-2026-64531: net: openvswitch: reject oversized nested action attrs
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8439 JIRA: https://redhat.atlassian.net/browse/RHEL-222498 CVE: CVE-2026-64531 Backported from tree(s): linux ``` net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure. Fixes: a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") Cc: stable@vger.kernel.org Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me> Reviewed-by: Eelco Chaudron <echaudro@redhat.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260706094336.38639-1-manizada@pm.me Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit 3f1f755366687d051174739fb99f7d560202f60b) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-07-31 12:10 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Timothy Redaelli <tredaelli@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5fd73ab01f |
Merge: hung_task: selected improvements
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8405
JIRA: https://issues.redhat.com/browse/RHEL-146503
This MR brings three small improvements to hung_task detector. The upstream
commit
|
||
|
CKI KWF Bot
|
406e208e0c |
Merge: futex: Optimize futex hash bucket access patterns
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8401 JIRA: https://redhat.atlassian.net/browse/RHEL-212733 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8401 Omitted-fix: fa188edc671d ("linux/bitfield.h: replace __auto_type with auto") Omitted-fix: 8fedac321fb0 ("mm/mempolicy: fix weighted interleave auto sysfs name") Not needed because RHEL9 doesn't have commit e341f9c3c841 ("mm/mempolicy: Weighted Interleave Auto-tuning") which introduces the "auto" sysfs file. This MR backports commit a734d9fca84e ("futex: Optimize futex hash bucket access patterns") to improve the futex hashing performance as measured by the "perf bench futex hash" benchmark to a level comparable with that of RHEL 9.7. Patch 1 is a dependency that is used to simplify the backport. When running the “perf bench futex hash” benchmark on a 2-sock 96-thread CascadeLake test system, the test results before and after the patch are as follows: ``` Baseline Patched Delta -b 16 143,724 158,095 +10.0% -b 64 214,471 282,900 +32.0% -b 256 540,852 716,517 +32.5% -b 512 768,584 1,041,867 +35.6% -b 1024 964,341 1,277,484 +32.5% -b 4096 1,625,843 1,671,285 + 2.8% -b 16384 1,663,403 1,710,355 + 2.8% -b 65536 1,747,447 1,819,797 + 4.1% ``` Signed-off-by: Waiman Long <longman@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Phil Auld <pauld@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
55706e41c1 |
Merge: Wireless core and drivers rebase to v7.1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8320 JIRA: https://issues.redhat.com/browse/RHEL-186475 Tested: basic testing with several supported WiFi cards (Intel, Qualcomm, Mediatek and Realtek). Wireless core and drivers update to v7.1 Upstream status: linux.git Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8309 Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8206 Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8130 Not supported drivers: Omitted-fix: c882b7a603ef wifi: at76c50x: drop redundant device reference Omitted-fix: ea06baf59bd4 wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() Omitted-fix: 32a0e1c63cdf wifi: ipw2x00: Use michael_mic() from cfg80211 Omitted-fix: 75e375816392 wifi: libertas: drop redundant device reference Omitted-fix: b1af0de313bd wifi: libertas_tf: drop redundant device reference Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5683e4bffe |
Merge: mhi bus update to 7.1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8309 JIRA: https://redhat.atlassian.net/browse/RHEL-186474 MHI bus rebase to linux kernel upstream version v7.1 It will be used by Wireless (Wifi and WWAN) and automotive components. Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8206 Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8130 Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com> Approved-by: Mattijs Korpershoek <mkorpershoek@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e05a2338f5 |
[redhat] kernel-5.14.0-734.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
4e4ce5c460 |
Merge: Sync CIFS/smbdirect with upstream [rhel-9.9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8450 - Sync CIFS/smbdirect with upstream JIRA: https://issues.redhat.com/browse/RHEL-216926 Signed-off-by: Paulo Alcantara <paalcant@redhat.com> Omitted-fix: fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()") Approved-by: Roberto Bergantinos Corpas <rbergant@redhat.com> Approved-by: Scott Mayhew <smayhew@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
4c37a8dfbc |
Merge: rtla: Stop the record trace on interrupt && rtla/timerlat_top: Fix on-threshold actions firing on signal [rhel-9]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8424 # Merge Request Required Information JIRA: https://redhat.atlassian.net/browse/RHEL-207773 ## Summary of Changes Tl;dr: RTLA 7.1 rebase MR (https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7953) pulled in an incorrect fix of an earlier issue that together with another oversight lead to a bug in on-threshold actions of rtla-timerlat-top tool (see the JIRA for details); this pulls in fixes for both. ## Approved Development Ticket(s) All submissions to CentOS Stream must reference a ticket in [Red Hat Jira](https://issues.redhat.com/). <details><summary>Click for formatting instructions</summary> Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/centos-stream-docs/contributors-guide/) for how to file this ticket and have it approved. List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate. </details> Signed-off-by: Tomas Glozar <tglozar@redhat.com> Approved-by: Wander Lairson Costa <wander@redhat.com> Approved-by: Gabriele Monaco <gmonaco@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
d318f69451 |
Merge: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8422 # Merge Request Required Information ## Summary of Changes JIRA: https://redhat.atlassian.net/browse/RHEL-213219 CVE: CVE-2026-63888 Fix a buffer overread and a potential double free of a stale pointer ## Approved Development Ticket(s) All submissions to CentOS Stream must reference a ticket in [Red Hat Jira](https://issues.redhat.com/). <details><summary>Click for formatting instructions</summary> Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/centos-stream-docs/contributors-guide/) for how to file this ticket and have it approved. List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate. </details> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Approved-by: djeffery1 <djeffery@redhat.com> Approved-by: Chris Leech <cleech@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
84a1cee016 |
Merge: dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8381 JIRA: https://redhat.atlassian.net/browse/RHEL-212062 Backported from tree(s): net ``` dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() When a dpll_pin is shared across multiple dpll_device instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync(). This happens under the following conditions: - A pin is registered with two or more dpll devices (dpll_A, dpll_B) - The pin has ref_sync pairs with other pins - During unregistration of dpll_A's pins, a ref_sync partner pin is unregistered first, removing it from dpll_A->pin_refs - But since the partner pin is still registered with dpll_B, its dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT run and the partner stays in the pin's ref_sync_pins xarray - When the pin itself is then unregistered from dpll_A, the delete notification calls dpll_msg_add_pin_ref_sync() which finds the partner in ref_sync_pins, passes dpll_pin_available() (partner is still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A, partner) returns NULL because partner was already removed from dpll_A->pin_refs - The NULL priv pointer is passed to the driver's ref_sync_get callback, which dereferences it BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x] Call Trace: dpll_msg_add_pin_ref_sync+0xb8/0x200 dpll_cmd_pin_get_one+0x3b6/0x4b0 dpll_pin_event_send+0x72/0x140 __dpll_pin_unregister+0x5a/0x2b0 dpll_pin_unregister+0x49/0x70 Fix this by skipping ref_sync pins whose priv pointer cannot be resolved for the current dpll device. Fixes: 58256a26bfb3 ("dpll: add reference sync get/set") Signed-off-by: Ivan Vecera <ivecera@redhat.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260710193625.1378822-1-ivecera@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit d2e914a4a0d0f753dbae830264850d044026167c) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-07-17 13:10 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: Michal Schmidt <mschmidt@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e604f77a4e |
Merge: ice: Tx ref clock feature
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8354 JIRA: https://redhat.atlassian.net/browse/RHEL-193816 Depends: !8346 Depends: !8353 Backport the upstream ice driver patches for the Tx ref clock feature. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: Petr Oros <poros@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
88f16c938d |
Merge: qede: build_skb failure causes off-by-one BD ring corruption and kernel panic
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8350
JIRA: https://redhat.atlassian.net/browse/RHEL-193044
Backported from tree(s): net
```
qede: fix off-by-one in BD ring consumption on build_skb failure
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.
Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")
added a NULL check inside qede_build_skb() to prevent a NULL pointer
dereference, but did not address the missing NULL checks in the
callers, making this off-by-one reachable.
Fix this by adding NULL checks for the return value of
qede_build_skb() in both qede_rx_build_skb() and
qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring
manipulation.
Fixes:
|
||
|
CKI KWF Bot
|
e2435d0819 |
Merge: [RHEL-9.9] x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8310 JIRA: https://redhat.atlassian.net/browse/RHEL-188795 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=71174970 Upstream status: v7.1 CVE: CVE-2025-54518 Conflicts: - arch/x86/kernel/cpu/amd.c: Omitted contextual differences added by a74bb5f202da ("x86/CPU/AMD: Disable INVLPGB on Zen2") and 5b937a1ed64e ("x86/rdrand: Disable RDSEED on AMD Cyan Skillfish") not present in RHEL 9 commit c21b90f77687075115d989e53a8ec5e2bb427ab1 Author: Prathyushi Nangia <prathyushi.nangia@amd.com> Date: Tue Dec 9 10:01:33 2025 -0600 x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure resources are not improperly shared in the op cache and cause instruction corruption this way. Signed-off-by: Prathyushi Nangia <prathyushi.nangia@amd.com> Co-developed-by: Borislav Petkov (AMD) <bp@alien8.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Assisted-by: Patchpal Signed-off-by: Dennis Chen <dechen@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
9849b947ca |
Merge: redhat: sign UKI's inner vmlinuz with modules signing key
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8071 JIRA: https://redhat.atlassian.net/browse/RHEL-223629 The existing workflow which puts SB-signed vmlinuz in the UKI and then SB-signs the UKI itself may be problematic for the situation when build time signing is unavailable. Switch to using the transient module signing key for signing vmlinuz which gets included into the UKI. This ensures that the extracted vmlinuz can be used for kexec/kdump. Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Approved-by: Jan Stancek <jstancek@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f343ba5ada |
[redhat] kernel-5.14.0-733.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
8d247149ed |
Merge: CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8433
JIRA: https://redhat.atlassian.net/browse/RHEL-219617
CVE: CVE-2026-64320
Backported from tree(s): linux
```
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
nvmet_execute_disc_get_log_page() validates only the dword alignment
of the host-supplied Log Page Offset (lpo). The 64-bit offset is then
added to a small kzalloc'd buffer that holds the discovery log page
and the result is passed straight to nvmet_copy_to_sgl(), which
memcpy()s data_len bytes out to the host with no source-side bound
check:
u64 offset = nvmet_get_log_page_offset(req->cmd); /* 64-bit host */
size_t data_len = nvmet_get_log_page_len(req->cmd); /* 32-bit host */
...
if (offset & 0x3) { ... } /* only check */
...
alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);
buffer = kzalloc(alloc_len, GFP_KERNEL);
...
status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);
The Discovery controller is unauthenticated -- nvmet_host_allowed()
returns true unconditionally for the discovery subsystem -- so the call
is reachable pre-authentication by any TCP/RDMA/FC peer that can reach
the nvmet target. With a discovery log page of ~1 KiB, an attacker
requesting up to 4 KiB starting at offset == alloc_len reads the next
slab page out and gets its content returned over the fabric (an
empirical run on a default nvmet-tcp loopback target leaked 81
canonical kernel pointers in one Get Log Page response). Pointing the
offset at unmapped kernel memory faults the in-kernel memcpy and
crashes (or panics, on panic_on_oops=1) the target host instead.
The attacker-controlled source-side offset pattern
"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)" is unique
to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every
other Get Log Page handler in admin-cmd.c either ignores lpo (and
silently starts every response at offset 0) or tracks a local
destination offset with a fixed source pointer.
Validate the host-supplied offset against the log page size, cap the
copy length to what is actually available, and zero-fill any remainder
of the host transfer buffer. The zero-fill matches the existing
short-response pattern in nvmet_execute_get_log_changed_ns()
(admin-cmd.c) and prevents leaking transport SGL contents when the
host asks for more bytes than the log page contains.
Fixes:
|
||
|
CKI KWF Bot
|
a79424b8dc |
Merge: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8392
JIRA: https://redhat.atlassian.net/browse/RHEL-212990
Backported from tree(s): linux
```
net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using
the PF's log_max_current_uc/mc_list capabilities. When querying a VF
vport with a larger configured max (via devlink), the firmware response
can overflow this buffer:
BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core]
Read of size 4 at addr ff1100013ffc8a12 by task kworker/u96:2/385
CPU: 12 UID: 0 PID: 385 Comm: kworker/u96:2 Not tainted 7.0.0-rc6+ #1 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core]
Call Trace:
<TASK>
dump_stack_lvl+0x69/0xa0
print_report+0x176/0x4e4
kasan_report+0xc8/0x100
mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core]
esw_update_vport_addr_list+0x2e3/0xda0 [mlx5_core]
esw_vport_change_handle_locked+0xa1f/0x1060 [mlx5_core]
esw_vport_change_handler+0x6a/0x90 [mlx5_core]
process_one_work+0x87f/0x15e0
worker_thread+0x62b/0x1020
kthread+0x375/0x490
ret_from_fork+0x4dc/0x810
ret_from_fork_asm+0x11/0x20
</TASK>
Fix by querying the vport's own HCA caps to size the buffer correctly.
Refactor the function to allocate and return the MAC list internally,
removing the caller's dependency on knowing the correct max.
Fixes:
|
||
|
CKI KWF Bot
|
16b126903e |
Merge: DRM Stable Backport (v7.0.14)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8272 The DRM backport's goal is to backport all the changes in the DRM subsystem to the kernel target version, with the biggest value being that we get the upstream hardware enablement (and bug fixes) into RHEL. After the [7.0 DRM Backport](https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8121), this MR backport as many fixes from the linux-stable tree for the target version: v7.0.13 Other: JIRA: https://issues.redhat.com/browse/RHEL-180329 Signed-off-by: Anusha Srivatsa <asrivats@redhat.com> Approved-by: Eric Chanudet <echanude@redhat.com> Approved-by: José Expósito <jexposit@redhat.com> Approved-by: John Wiele <jwiele@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
66eed0fcb5 |
[redhat] kernel-5.14.0-732.el9
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
fb579173ca |
Merge: [RHEL-9.9] crypto: tegra - fix rctx->cryptlen calculation
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8466 JIRA: https://redhat.atlassian.net/browse/RHEL-168738 Backported from tree(s): crypto, cryptodev ``` crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer. As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively. Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") Signed-off-by: Vladislav Dronov <vdronov@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> (cherry picked from commit 360f2974fcea49c61f6d6f81554741a9eeee7168) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-08-03 21:40 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Vladislav Dronov <vdronov@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
93c6c3703d |
Merge: xfrm: fix three CVE and one race issues
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8437 JIRA: https://redhat.atlassian.net/browse/RHEL-180034 JIRA: https://redhat.atlassian.net/browse/RHEL-154906 JIRA: https://redhat.atlassian.net/browse/RHEL-180173 JIRA: https://redhat.atlassian.net/browse/RHEL-178340 CVE: CVE-2025-39797 CVE: CVE-2026-23239 CVE: CVE-2026-46116 Fix three CVE and one race issues Signed-off-by: Xin Long <lxin@redhat.com> Approved-by: Íñigo Huguet <ihuguet@riseup.net> Approved-by: Sabrina Dubroca <sdubroca@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
006970f36d |
Merge: redhat: Add DENYLIST.rhel to BPF selftests
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8431 JIRA: https://redhat.atlassian.net/browse/RHEL-213547 Upstream Status: RHEL only ARK: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/4426 Conflicts: Necessary context changes in kernel.spec.template file caused by RHEL9 missing numerous commits compared to ARK. The list of tests on DENYLIST were reduced down to a single test as the rest of the tests are either not in RHEL9 or they are passing. Additional details are provided in the attached JIRA issue. ``` commit e325a62142ca8d5a4fde32b1ed8b32f24cfd5e96 Author: Viktor Malik <vmalik@redhat.com> Date: Mon Mar 30 15:03:17 2026 +0200 redhat: Add DENYLIST.rhel to BPF selftests Upstream status: RHEL only BPF upstream requires specific kernel configuration (defined in tools/testing/selftests/bpf/config*) for the BPF selftests to pass. RHEL does not enable some of the required options and therefore some test cases cannot pass. Upstream uses the DENYLIST file to filter out buggy and flaky tests. To respect that, add a new file DENYLIST.rhel containing the aforementioned test cases. During RPM build, we append the file contents to the global DENYLIST that is now also copied to kernel-selftests-internal. DENYLIST can be applied in test_progs with: # ./test_progs -d @DENYLIST Signed-off-by: Viktor Malik <vmalik@redhat.com> ``` Signed-off-by: Veronika Molnarova <vmolnaro@redhat.com> Approved-by: Viktor Malik <vmalik@redhat.com> Approved-by: Jan Stancek <jstancek@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
 CKI KWF BotandCursor
|
2504d7a69b |
Merge: redhat: add kmap.py tool and kernel-kmap-internal package
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8430 JIRA: INTERNAL Upstream Status: RHEL-Only Introduce kmap.py, a tool that creates JSON mappings of which source files contribute to which kernel binaries (modules and vmlinux), and add a new kernel-kmap-internal RPM package that ships the generated mapping data. This enables tooling to trace kernel binaries back to their original source files, useful for debugging, security analysis, and build verification. The tool parses kernel build artifacts (.cmd files generated by kbuild) to extract compilation information. It supports: - C source files compiled with gcc or clang - Rust source files compiled with rustc - Built-in objects via built-in.a archives (RHEL 9 kbuild) - Multiple kernel variants merged into a single output file - Module-to-RPM package mapping The new kernel-kmap-internal package contains a JSON file (kernel-map-<KVERREL>.json) with the structure: ``` { "variants": ["stock", "rt", ...], "source-map": { "obj-src": {<object>: {<source>: [<variant_indices>]}}, "src-obj": {<source>: {<object>: [<variant_indices>]}} }, "module-map": { "module-rpm": {<module>: {<rpm_name>: [<variant_indices>]}}, "rpm-modules": {<rpm_name>: {<module>: [<variant_indices>]}} } } ``` Variant indices are positions in the 'variants' list, indicating which variants each mapping applies to. The package is built for x86_64, ppc64le, s390x, and aarch64. Debug variants are skipped (same source mapping as base). Installed to: /usr/share/kernel-kmap-internal/kernel-map-<KVERREL>.json Backported from kernel-ark commit 46f9eda70367. Signed-off-by: Rado Vrbovsky <rvrbovsk@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com> Approved-by: Jan Stancek <jstancek@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5471030c72 |
Merge: gfs2: Don't cache unused glocks
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8427 JIRA: https://redhat.atlassian.net/browse/RHEL-190801 This patch series changes gfs2 to drop glocks as soon as possible after their corresponding inodes are evicted (by being deleted or being forced out due to memory pressure). This causes the corresponding DLM locks to be unlocked much sooner, which smooths out DLM unlocking load spikes at unmount time. Before this patch set, the glocks were only forced out in response to memory pressure, as well as at filesystem unmount time. Unlocking the corresponding DLM locks is somewhat slow though, so depending on the workload, a lot of memory could get tied up unnecessarily. In addition, some workloads could cause filesystem unmount time to skyrocket. By not caching unused glocks, we can also get rid of the glocks LRU list. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Approved-by: Andrew Price <anprice@redhat.com> Approved-by: Abhi Das <adas@redhat.com> Approved-by: Paul Evans <pevans@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
9a55453fae |
Merge: CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8423 JIRA: https://redhat.atlassian.net/browse/RHEL-189941 CVE: CVE-2025-68214 commit 20739af07383e6eb1ec59dcd70b72ebfa9ac362c Author: Yipeng Zou <zouyipeng@huawei.com> Date: Sat, 22 Nov 2025 09:39:42 +0000 timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers(). The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this: CPU0 CPU1 <SOFTIRQ> lock_timer_base() expire_timers() base->running_timer = timer; unlock_timer_base() [call_timer_fn enter] mod_timer() ... timer_shutdown_sync() lock_timer_base() // For now, will not detach the timer but only clear its function to NULL if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() [call_timer_fn exit] lock_timer_base() base->running_timer = NULL; unlock_timer_base() ... // Now timer is pending while its function set to NULL. // next timer trigger <SOFTIRQ> expire_timers() WARN_ON_ONCE(!fn) // hit ... lock_timer_base() // Now timer will detach if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() The problem is that timer_shutdown_sync() clears the timer function regardless of whether the timer is currently running. This can leave a pending timer with a NULL function pointer, which triggers the WARN_ON_ONCE(!fn) check in expire_timers(). Fix this by only clearing the timer function when actually detaching the timer. If the timer is running, leave the function pointer intact, which is safe because the timer will be properly detached when it finishes running. Fixes: 0cc04e80458a ("timers: Add shutdown mechanism to the internal functions") Signed-off-by: Yipeng Zou <zouyipeng@huawei.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251122093942.301559-1-zouyipeng@huawei.com Signed-off-by: Waiman Long <longman@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: Scott Weaver <scweaver@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f9e24b95c7 |
Merge: gfs2: xfstests generic/363 failure
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8408 JIRA: https://redhat.atlassian.net/browse/RHEL-213745 Backported from tree(s): linux ``` gfs2: page poisoning fix Processes can write to the last page of a file using mmap, and when the file size is not a multiple of the page size, this can be used to write beyond the end of the file. This is sometimes referred to as page poisoning, and it is not a problem in itself because the data beyond eof will be ignored. However, we currently fail to clear out any space beyond the end of the file that we skip over when the file size is increased, so that "poison" can end up getting exposed. Fix that. Fixes xfstest generic/363. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> (cherry picked from commit 4982e58669b11c43644efb5fb7435975848b716e) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-07-22 16:10 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Paul Evans <pevans@redhat.com> Approved-by: Andreas Gruenbacher <agruenba@redhat.com> Approved-by: Abhi Das <adas@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
9c58f629fa |
Merge: scsi: core: wake eh reliably when using scsi_schedule_eh
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8406
JIRA: https://redhat.atlassian.net/browse/RHEL-113832
Upstream Status: From upstream linux mainline
Conflicts: KABI changes
Drivers which use the scsi_schedule_eh function to run the error handler
currently risk the error handler thread never waking once all commands are
timed out or inactive. There is no enforced memory order between setting
the host into error recovery state and counting busy commands. This can
result in a race with scsi_dec_host_busy where neither CPU sees both
conditions of all commands inactive and the host error state to request
waking the error handler.
To fix this, run the scsi_schedule_eh's scsi_eh_wakeup from a new work item
which will use rcu to ensure scsi_schedule_eh's call to scsi_host_busy will
occur after the error state is globally visible and will be seen by any
current scsi_dec_host_busy callers.
Fixes:
|
||
|
CKI KWF Bot
|
353c570b4b |
Merge: CVE-2026-64017: blk-mq: pop cached request if it is usable
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8398 JIRA: https://redhat.atlassian.net/browse/RHEL-213155 CVE: CVE-2026-64017 * dc278e9bf2b9513a763353e6b9cc21e0f532954e blk-mq: pop cached request if it is usable [linux] * b051bb6bf0a231117036aa607cadf55be8e63910 blk-mq: reinsert cached request to the list [linux] Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-07-21 14:20 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Jeff Moyer <jmoyer@redhat.com> Approved-by: John Pittman <jpittman@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5cf0fab5f8 |
Merge: cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8395 JIRA: https://issues.redhat.com/browse/RHEL-212691 commit 27d80e0f8b8dff97503fc0061754b1d3800cb961 Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Date: Tue Jul 7 19:19:55 2026 +0200 cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() Setting cpu->capacity_perf to cpu->pstate.max_pstate_physical in the "no turbo" case is inconsistent with what happens elsewhere in the driver and causes arch_scale_cpu_capacity() to be incorrect. It also skews arch_scale_freq_capacity() which ends up differing from 1024 for the guaranteed P-state. Address that by setting capacity_perf to HWP_GUARANTEED_PERF() in the "no turbo" case. Fixes: 929ebc93ccaa ("cpufreq: intel_pstate: Set asymmetric CPU capacity on hybrid systems") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> Cc: All applicable <stable@vger.kernel.org> Link: https://patch.msgid.link/12928972.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f5106e9659 |
Merge: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8389 JIRA: https://redhat.atlassian.net/browse/RHEL-212684 Conflicts: In context only as CentOS/RHEL do not have: 96ea3a1e2d3 ("can: add CAN skb extension infrastructure") c2aba69d0c3 ("can: bcm: add locking for bcm_op runtime updates") These commits are not dependencies. Signed-off-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Jay Shin <jaeshin@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
3c3a018147 |
Merge: Apply select fixes to drivers/watchdog
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8388 JIRA: https://issues.redhat.com/browse/RHEL-192487 These commits fix potential bugs in RHEL. Signed-off-by: David Arcari <darcari@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
47ade36ff9 |
Merge: USB/TBT code rebase of supported drivers to upstream v7.0
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8370 JIRA: https://issues.redhat.com/browse/RHEL-147798 This MR rebases supported usb/tbt/memstick/extcon drivers to upstream kernel v7.0. By design, rebase changes are limited to supported drivers and their relevant physical infrastructure. Treewide changes which touch these drivers are partially pulled in, whenever found out to be relevant. 1) CVEs: ``` CVE: CVE-2026-43259 CVE: CVE-2026-43170 CVE: CVE-2026-43425 CVE: CVE-2026-43429 CVE: CVE-2026-43428 CVE: CVE-2026-43427 CVE: CVE-2026-43432 CVE: CVE-2026-43488 CVE: CVE-2026-31758 CVE: CVE-2026-31729 CVE: CVE-2026-31759 CVE: CVE-2026-46109 ``` 2) Addition/Removal of code: This MR also adds ethtool speed codes to allow the Thunderbolt/USB4 net- working driver to be used with the bonding driver. Furthermore, the MR also passes IRQF_ONESHOT directly in devm_request_irq() at genirq, since this flag is being removed from irqflags in multiple drivers. Signed-off-by: Desnes Nunes <desnesn@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: mheib <mheib@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com> Approved-by: Dennis Chen <dechen@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
c00289783f |
Merge: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8369 # Merge Request Required Information ## Summary of Changes KVM: x86: Fix shadow paging use-after-free due to unexpected role ``` JIRA: https://redhat.atlassian.net/browse/RHEL-192402 CVE: CVE-2026-53359 Backported from tree(s): linux KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free. Fixes: |
||
|
CKI KWF Bot
|
4b460011c4 |
Merge: nvme: Introduce tunable timeouts
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8368 # Merge Request Required Information ## Summary of Changes JIRA: https://redhat.atlassian.net/browse/RHEL-210643 This patchset tries to address some limitations in how the NVMe driver handles command timeouts. Currently, the driver relies heavily on global module parameters (NVME_IO_TIMEOUT and NVME_ADMIN_TIMEOUT), making it difficult for users to tune timeouts for specific controllers that may have very different characteristics. Also, in some cases, manual changes to sysfs timeout values are ignored by the driver logic. For example this patchset removes the unconditional timeout assignment in nvme_init_request. This allows the block layer to correctly apply the request queue's timeout settings, ensuring that user-initiated changes via sysfs are actually respected for all requests. It introduces new sysfs attributes (admin_timeout and io_timeout) to the NVMe controller. This allows users to configure distinct timeout requirements for different controllers rather than relying on global module parameters. Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> ## Approved Development Ticket(s) All submissions to CentOS Stream must reference a ticket in [Red Hat Jira](https://issues.redhat.com/). <details><summary>Click for formatting instructions</summary> Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/centos-stream-docs/contributors-guide/) for how to file this ticket and have it approved. List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate. </details> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: Chris Leech <cleech@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
c42e6ac48d |
Merge: Update Bluetooth stack for stable kernel v6.18.y (v6.18.38)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8363 Update the Bluetooth driver to sync with recent Long Term Stable (LTS) upstream branch (v6.18.38) JIRA: https://redhat.atlassian.net/browse/RHEL-194201 Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8175 The following commits have not been pulled into the 6.18.y stable branch, so omitting for now. Omitted-fix: b66774b48dd98 Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Omitted-fix: d38eaf611839b Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Omitted-fix: 1b0d946d6f08b Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled Omitted-fix: e054c1a6ae731 Bluetooth: ISO: fix malformed ISO_END/CONT handling Omitted-fix: 4bd0b274054f2 Bluetooth: fix UAF in bt_accept_dequeue() Signed-off-by: David Marlin <dmarlin@redhat.com> Approved-by: Bastien Nocera <bnocera@redhat.com> Approved-by: Krzysztof Pawlinski <kpawlins@redhat.com> Approved-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5f74d16576 |
Merge: dpll: sync with upstream v7.2-rc2
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8353 JIRA: https://redhat.atlassian.net/browse/RHEL-193749 Update the dpll subsystem to current upstream, v7.2-rc2. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: Petr Oros <poros@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e64965ae7f |
Merge: ice: driver update to net/main (2026-07-08)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8346 JIRA: https://redhat.atlassian.net/browse/RHEL-177450 CVE: CVE-2026-23389 CVE: CVE-2026-43346 CVE: CVE-2026-46162 CVE: CVE-2026-53007 CVE: CVE-2026-53008 CVE: CVE-2026-53009 Update the ice driver to net/main as of 2026-07-08. Notable remaining differences from upstream after this MR: - added hacks for interface names compatibility with 9.0 and opt-in to RHEL 10 naming - no PFCP support - xdp & xsk changes - udp_tunnel changes - no conversion to page pool - no Rx and Tx queue fields reshuffling - no BIG TCP IPv6 Tx path conversion - no treewide kmalloc_obj conversions - no snapshot clock ID - no TXC DPLL device and Tx ref clock (yet) - no CPI (yet) The Tx ref clock and CPI features are in a followup MR, !8354. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Approved-by: Petr Oros <poros@redhat.com> Approved-by: Jakub Ramaseuski <jramaseu@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
71b3c5829b |
Merge: CVE-2025-68211 kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8345 An unprivileged local user can mark a huge sparse anonymous mapping (e.g. tens of TiB with only a few pages populated) as MADV_MERGEABLE, which causes ksmd to walk every virtual page address instead of skipping unmapped holes. That pins a CPU for a long time and effectively stalls Kernel Samepage Merging, so it is a local denial-of-service against the system’s page-deduplication path. The fix switches scan_get_next_rmap_item() to walk_page_range() so KSM jumps over holes and only scans mapped pages. The following commit comes from the 6.6 stable tree. CVE: CVE-2025-68211 JIRA: https://redhat.atlassian.net/browse/RHEL-189902 Signed-off-by: Nico Pache <npache@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: Luiz Capitulino <luizcap@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
99b79822c1 |
Merge: tls: backport CVE and other bug fixes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8341 JIRA: https://redhat.atlassian.net/browse/RHEL-152694 JIRA: https://redhat.atlassian.net/browse/RHEL-154836 JIRA: https://redhat.atlassian.net/browse/RHEL-189938 CVE: CVE-2025-40149 CVE: CVE-2026-23240 Backport some upstream fixes, including some CVEs. Signed-off-by: Sabrina Dubroca <sdubroca@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Jay Shin <jaeshin@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f56c2fc194 |
Merge: net: fix some zerocopy-related CVEs
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8338 JIRA: https://redhat.atlassian.net/browse/RHEL-176061 JIRA: https://redhat.atlassian.net/browse/RHEL-177879 JIRA: https://redhat.atlassian.net/browse/RHEL-178626 JIRA: https://redhat.atlassian.net/browse/RHEL-192925 CVE: CVE-2026-43503 CVE: CVE-2026-46300 CVE: CVE-2026-46323 Fix some CVEs Signed-off-by: Sabrina Dubroca <sdubroca@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Jay Shin <jaeshin@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
4c8bcb4e2e |
Merge: i2c: tegra: Update Tegra410 I2C timing parameters - RHEL 9.9
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8302 JIRA: https://issues.redhat.com/browse/RHEL-174251 This patch series backported from linux 7.2 ensures that the Tegra410 i2c driver is in compliance with the i2c specification. Signed-off-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: Tony Camuso <tcamuso@redhat.com> Approved-by: Dennis Chen <dechen@redhat.com> Approved-by: Mark Salter <msalter@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
128e7f84f8 |
Merge: netfilter: CVE backport for RHEL 9.9
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8284 JIRA: https://redhat.atlassian.net/browse/RHEL-186601 CVE: CVE-2026-53002 CVE: CVE-2026-53001 CVE: CVE-2026-52999 CVE: CVE-2026-52998 CVE: CVE-2026-52986 CVE: CVE-2026-52981 CVE: CVE-2026-52970 CVE: CVE-2026-52942 CVE: CVE-2026-52920 CVE: CVE-2026-52915 CVE: CVE-2026-52912 CVE: CVE-2026-46324 CVE: CVE-2026-45841 CVE: CVE-2026-43085 CVE: CVE-2026-43028 CVE: CVE-2026-43026 CVE: CVE-2026-43025 CVE: CVE-2026-43024 CVE: CVE-2026-31681 CVE: CVE-2026-31674 CVE: CVE-2026-31665 CVE: CVE-2026-31496 CVE: CVE-2026-31424 CVE: CVE-2026-31418 CVE: CVE-2026-31416 CVE: CVE-2026-31414 CVE: CVE-2026-23385 CVE: CVE-2026-23351 CVE: CVE-2026-23278 CVE: CVE-2025-68206 CVE: CVE-2025-40206 CVE: CVE-2025-38201 CVE: CVE-2025-38162 CVE: CVE-2024-56655 Also includes other patches that don't have a CVE assigned but have memory safety implications. There are only very few patches that are only included to reduce conflicts. I omitted several conntrack expectation related patches because they are intrusive, very new, and still require more followup work upstream. Omitted-fix: cbd2257dc96e ("netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support"). Feature patch we don't want, one of the patches in this series has this as "Fixes" tag but I think not having a validate callback is bad, hence that fix was picked up even though the alleged culprit is not in RHEL9. Omitted-fix: 33758c891479 ("memcg: enable accounting for nft objects") Not strictly a bug fix, could cause failures if we account them now Omitted-fix: f37ad9127039 ("netfilter: nf_dup_netdev: Move the recursion counter struct netdev_xmit") Needed to preepmt-rt, but out of scope for this CVE, oter similar changes missing as well Signed-off-by: Florian Westphal <fwestpha@redhat.com> Closes: RHEL-186601 Approved-by: Eric Garver <egarver@redhat.com> Approved-by: Phil Sutter <psutter@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
2c2a6a04ac |
Merge: Possible regression with FM350GL
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8262 JIRA: https://redhat.atlassian.net/browse/RHEL-184267 Backported from tree(s): linux ``` net: wwan: t7xx: Add delay between MD and SAP suspend SAP (Service Access Point) suspend occasionally times out with error -110 (ETIMEDOUT), followed by modem port errors and complete modem failure requiring a system reboot to recover. Error symptoms: mtk_t7xx 0000:72:00.0: [PM] SAP suspend error: -110 mtk_t7xx 0000:72:00.0: can't suspend (...returned -110) mtk_t7xx 0000:07:00.0: Failed to send skb: -22 mtk_t7xx 0000:07:00.0: Write error on MBIM port, -22 The modem firmware needs time after receiving the MD (modem) suspend request to complete internal operations before it is ready to accept the SAP suspend request. Without this delay, if runtime PM attempts to suspend while the firmware is busy, the SAP suspend command times out, leaving the modem in an unrecoverable state. Root cause and userspace interaction: ModemManager 1.24+ includes changes that reduce the likelihood of this issue by ensuring the modem is in a low-power state before the kernel attempts runtime suspend. However, the kernel driver should not depend on specific userspace behavior or ModemManager versions. Older versions (1.20-1.22) are still widely deployed, and the kernel should be robust regardless of userspace implementation details. There appears to be no hardware status register or other mechanism available to query whether the firmware is ready for SAP suspend. A delay between the two suspend requests is the most reliable solution found through testing. Add a 50ms delay between MD suspend and SAP suspend. This gives the firmware adequate time to complete internal operations without adding significant latency to the suspend path. This makes the driver robust across all ModemManager versions and system conditions. Testing: 96+ hours of continuous operation with ModemManager 1.20.2 and Fibocom FM350-GL modem. Zero SAP suspend timeouts observed across 2000+ successful suspend/resume cycles. Previously failed within 24 hours with 100% reproducibility. Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260527061451.12710-1-jtornosm@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit ae733795e593272f67d607c09d2a00637ac13ed0) ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-06-22 10:14 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com> Approved-by: Ivan Vecera <ivecera@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
915691dc9f |
Merge: octeon_ep_vf: bug fixes from v7.1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8257 JIRA: https://redhat.atlassian.net/browse/RHEL-182043 * f93fc5d12d69 net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback [linux] * 484e834d53cf octeon_ep_vf: ensure dbell BADDR updation [linux] * 2ae7d20fb24f octeon_ep_vf: Relocate counter updates before NAPI [linux] * 6c73126ecd10 octeon_ep_vf: avoid compiler and IQ/OQ reordering [linux] * 4e5bc3ff060e octeon_ep_vf: introduce octep_vf_oq_next_idx() helper [linux] * dd66b4285470 octeon_ep_vf: add NULL check for napi_build_skb() [linux] Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-06-19 08:11 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
ec8f0a6133 |
Merge: KVM: s390: Limit adapter indicator access to mapped page
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8248 JIRA: https://redhat.atlassian.net/browse/RHEL-183881 ``` 1c080c96ee12 KVM: s390: selftests: Add IRQ routing address offset tests ecd3cc7cbf07 KVM: s390: Limit adapter indicator access to mapped page ``` Signed-off-by: Christoph Schlameuss <cschlame@redhat.com> Approved-by: Cornelia Huck <cohuck@redhat.com> Approved-by: Thomas Huth <thuth@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
388b747fde |
Merge: CVE-2026-43276: net: mana: Fix double destroy_workqueue on service rescan PCI path
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8193 JIRA: https://redhat.atlassian.net/browse/RHEL-180269 CVE: CVE-2026-43276 * f975a0955276579e2176a134366ed586071c7c6a net: mana: Fix double destroy_workqueue on service rescan PCI path [linux] * 87c2302813abc55c46485711a678e3c312b00666 net/mana: Null service_wq on setup error to prevent double destroy [linux] Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-05-29 08:09 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer] Approved-by: ggoklani <ggoklani@redhat.com> Approved-by: Ani Sinha <anisinha@redhat.com> Approved-by: Vitaly Kuznetsov <vkuznets@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |