# changelog

author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-733.el9]
changelog:
  - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219617] {CVE-2026-64320}
  - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-212990]
  - drm/i915/display: enable ccs modifiers on dg2 (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Write REFCLK to 48MHz on DCN21 (Anusha Srivatsa) [RHEL-180329]
  - drm/panthor: Extend VM locked region for remap case to be a superset (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: Check if there are kfd porcesses using adev by kfd_processes_count (Anusha Srivatsa) [RHEL-180329]
  - dma-buf: fix UAF in dma_buf_put() tracepoint (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm: fix runtime PM imbalance issue in amdgpu_pm.c (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Bound VBIOS record-chain walk loops (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm: fix smu13 power limit default/cap calculation (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: restart the CS if some parts of the VM are still invalidated (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: fix waiting for all submissions for userptrs (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Clear pending_disable before signaling suspend fence (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/multi_queue: skip submit when primary queue is suspended (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/display: fix oops in suspend/shutdown without display (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: fix NULL dereference in get_queue_ids() (Anusha Srivatsa) [RHEL-180329]
  - drm/i915: Fix color blob reference handling in intel_plane_state (Anusha Srivatsa) [RHEL-180329]
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (Anusha Srivatsa) [RHEL-180329]
  - accel/ethosu: reject NPU_OP_RESIZE commands from userspace (Anusha Srivatsa) [RHEL-180329]
  - accel/ethosu: reject DMA commands with uninitialized length (Anusha Srivatsa) [RHEL-180329]
  - accel/ethosu: fix arithmetic issues in dma_length() (Anusha Srivatsa) [RHEL-180329]
  - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85 (Anusha Srivatsa) [RHEL-180329]
  - accel/ethosu: fix IFM region index out-of-bounds in command stream parser (Anusha Srivatsa) [RHEL-180329]
  - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (Anusha Srivatsa) [RHEL-180329]
  - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/gem: Fix phys BO pread/pwrite with offset (Anusha Srivatsa) [RHEL-180329]
  - Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" (Anusha Srivatsa) [RHEL-180329]
  - accel/ivpu: Fix signed integer truncation in IPC receive (Anusha Srivatsa) [RHEL-180329]
  - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (Anusha Srivatsa) [RHEL-180329]
  - accel/ivpu: Add bounds checks for firmware log indices (Anusha Srivatsa) [RHEL-180329]
  - accel/ivpu: Add bounds check for firmware runtime memory (Anusha Srivatsa) [RHEL-180329]
  - Revert "drm/xe/nvls: Define GuC firmware for NVL-S" (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: fix refcount leak in xe_range_fence_insert() (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: use plane color_mgmt_changed to track colorop changes (Anusha Srivatsa) [RHEL-180329]
  - drm/atomic: track individual colorop updates (Anusha Srivatsa) [RHEL-180329]
  - drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable (Anusha Srivatsa) [RHEL-180329]
  - drm/colorop: Remove read-only comments from interpolation fields (Anusha Srivatsa) [RHEL-180329]
  - drm/virtio: Fix driver removal with disabled KMS (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/edp: Check supported link rates DPCD read (Anusha Srivatsa) [RHEL-180329]
  - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: Check for pdd drm file first in CRIU restore path (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm/si: Disregard vblank time when no displays are connected (Anusha Srivatsa) [RHEL-180329]
  - drm/i915: Fix potential UAF in TTM object purge (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/color: Fix HDR pre-CSC LUT programming loop (Anusha Srivatsa) [RHEL-180329]
  - drm/gem: fix race between change_handle and handle_delete (Anusha Srivatsa) [RHEL-180329]
  - drm/hyperv: validate VMBus packet size in receive callback (Anusha Srivatsa) [RHEL-180329]
  - drm/hyperv: validate resolution_count and fix WIN8 fallback (Anusha Srivatsa) [RHEL-180329]
  - dma-buf: fix UAF in dma_buf_fd() tracepoint (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/psr: Read Intel DPCD workaround register (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Restore IDLEDLY regiter on engine reset (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/aux: use polling when irqs are unavailable (Anusha Srivatsa) [RHEL-180329]
  - accel/ivpu: prevent uninitialized data bug in debugfs (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/oa: Fix exec_queue leak on width check in stream open (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti (v2) (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4 (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/tuning: Apply windower hardware filtering setting on Xe3 and Xe3p (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1 (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Consolidate workaround entries for Wa_18033852989 (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Consolidate workaround entries for Wa_14019988906 (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/pf: Fix CFI failure in debugfs access (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/vf: Fix signature of print functions (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/gsc: Fix double-free of managed BO in error path (Anusha Srivatsa) [RHEL-180329]
  - drm/gem: Make the GEM LRU lock part of drm_device (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Validate GPIO pin LUT table size before iterating (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Fix integer overflow in bios_get_image() (Anusha Srivatsa) [RHEL-180329]
  - drm/bridge: megachips: remove bridge when irq request fails (Anusha Srivatsa) [RHEL-180329]
  - drm/bridge: it66121: acquire reset GPIO in probe (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vpe: Force collaborate sync after TRAP (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/multi_queue: Fix secondary queue error case (Anusha Srivatsa) [RHEL-180329]
  - drm/virtio: use uninterruptible resv lock for plane updates (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/display: Copy color pipeline from plane in the primary joiner pipe (Anusha Srivatsa) [RHEL-180329]
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (Anusha Srivatsa) [RHEL-180329]
  - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (Anusha Srivatsa) [RHEL-180329]
  - drm/gma500/oaktrail_lvds: fix hang on init failure (Anusha Srivatsa) [RHEL-180329]
  - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (Anusha Srivatsa) [RHEL-180329]
  - drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-180329]
  - drm/i915: skip __i915_request_skip() for already signaled requests (Anusha Srivatsa) [RHEL-180329]
  - drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (Anusha Srivatsa) [RHEL-180329]
  - drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup (Anusha Srivatsa) [RHEL-180329]
  - drm: Replace old pointer to new idr (Anusha Srivatsa) [RHEL-180329]
  - drm/loongson: Use managed KMS polling (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/xelp: Fix Wa_18022495364 (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/debugfs: Correct printing of register whitelist ranges (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge() (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Use XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET enum instead of magic number (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Use EDID from VBIOS embedded panel info (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Read EDID from VBIOS embedded panel info (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Allow constructing DCE8 link encoder without DDC (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Allow constructing DCE6 link encoder without DDC (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Allow DCE link encoder without AUX registers (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Allow embedded connectors without DDC (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm: Add fine grained flag to SMU v13.0.6 (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: properly handle family setting for early GC 11.5.4 (Anusha Srivatsa) [RHEL-180329]
  - drm/color-mgmt: Typo s/R332/RGB332/ (Anusha Srivatsa) [RHEL-180329]
  - drm/sysfb: ofdrm: fix PCI device reference leaks (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Only send RMA CPER when threshold is exceeded (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm: fix missing fine-grained dpm table flag on aldebaran (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: avoid double drm_exec_fini() in userq validate (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/wm: Verify the correct plane DDB entry (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Fix parameter mismatch in panel self-refresh helper (Anusha Srivatsa) [RHEL-180329]
  - drm/fb-helper: Fix a locking bug in an error path (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm/ci: Fill DW8 fields from SMC (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (Anusha Srivatsa) [RHEL-180329]
  - drm/panel: simple: Correct G190EAN01 prepare timing (Anusha Srivatsa) [RHEL-180329]
  - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (Anusha Srivatsa) [RHEL-180329]
  - drm/imagination: Switch reset_reason fields from enum to u32 (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/gfx11: look at the right prop for gfx queue priority (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/gfx10: look at the right prop for gfx queue priority (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/ras: Remove redundant NULL check in pending bad-bank list iteration (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Remove dead negative offset check in amdgpu_virt_init_critical_region() (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Drop redundant queue NULL check in hang detect worker (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/ras: Fix NULL deref in ras_core_get_utc_second_timestamp() (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Add default case in DVI mode validation (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected() (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: Update queue properties for metadata ring (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm: Fix xgmi max speed reporting (Anusha Srivatsa) [RHEL-180329]
  - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (Anusha Srivatsa) [RHEL-180329]
  - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (Anusha Srivatsa) [RHEL-180329]
  - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: GFX12.1 scratch memory limit up to 57-bit (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/ras: Fix type size of remainder argument (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: Removed commented line for MQD queue priority (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/xe2_hpg: Drop invalid workaround Wa_15010599737 (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Consolidate workaround entries for Wa_14019386621 (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Consolidate workaround entries for Wa_14019877138 (Anusha Srivatsa) [RHEL-180329]
  - drm/virtio: Allow importing prime buffers when 3D is enabled (Anusha Srivatsa) [RHEL-180329]
  - drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm() (Anusha Srivatsa) [RHEL-180329]
  - dma-fence: Fix sparse warnings due __rcu annotations (Anusha Srivatsa) [RHEL-180329]
  - drm/panel: ilitek-ili9882t: Select DRM_DISPLAY_DSC_HELPER (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/pm: align Hawaii mclk workaround with radeon (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/pm: add missing revision check for CI (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: Make all TLB-flushes heavy-weight (Anusha Srivatsa) [RHEL-180329]
  - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (Anusha Srivatsa) [RHEL-180329]
  - drm/bridge: tda998x: Use __be32 for audio port OF property pointer (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (Anusha Srivatsa) [RHEL-180329]
  - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/userq: fix access to stale wptr mapping (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: zero-initialize GART table on allocation (Anusha Srivatsa) [RHEL-180329]
  - drm/radeon: add missing revision check for CI (Anusha Srivatsa) [RHEL-180329]
  - drm: Set old handle to NULL before prime swap in change_handle (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (Anusha Srivatsa) [RHEL-180329]
  - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-180329]
  - drm/udl: Increase GET_URB_TIMEOUT (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Avoid reset in AMDGPU unload path for APUs with GFX V11 and higher. (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: validate SVM ioctl nattr against buffer size (Anusha Srivatsa) [RHEL-180329]
  - drm/appletbdrm: Use kvzalloc for big allocations (Anusha Srivatsa) [RHEL-180329]
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: Change dither policy for 10 bpc output back to dithering (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vce: Prevent partial address patches (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Add bounds checking to ib_{get,set}_value (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: Add upper bound check for num_of_nodes (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: gate VM CPU HDP flush on reset lock (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: Use NBIF offset for register RCC_STRAP0_RCC_DEV0_EPF0_STRAP0 . (Anusha Srivatsa) [RHEL-180329]
  - drm/amd: Add missing firmware declaration for PSP v15.0.0 (Anusha Srivatsa) [RHEL-180329]
  - drm/amd/display: fix math_mod() using arg1 instead of arg2 (Anusha Srivatsa) [RHEL-180329]
  - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (Anusha Srivatsa) [RHEL-180329]
  - drm/i915/psr: Init variable to avoid early exit from et alignment loop (Anusha Srivatsa) [RHEL-180329]
  - drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property (Anusha Srivatsa) [RHEL-180329]
  - drm/colorop: Fix blob property reference tracking in state lifecycle (Anusha Srivatsa) [RHEL-180329]
  - drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() (Anusha Srivatsa) [RHEL-180329]
  - drm/atomic: Add affected colorops with affected planes (Anusha Srivatsa) [RHEL-180329]
  - drm/colorop: Preserve bypass value in duplicate_state() (Anusha Srivatsa) [RHEL-180329]
  - drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages (Anusha Srivatsa) [RHEL-180329]
  - drm/gpusvm: Allow device pages to be mapped in mixed mappings after system pages (Anusha Srivatsa) [RHEL-180329]
  - accel/ivpu: Disallow re-exporting imported GEM objects (Anusha Srivatsa) [RHEL-180329]
  - drm/imagination: Fix segfault when updating ftrace mask (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: fix zero-size GDS range init on RDNA4 (Anusha Srivatsa) [RHEL-180329]
  - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (Anusha Srivatsa) [RHEL-180329]
  - drm/arcpgu: fix device node leak (Anusha Srivatsa) [RHEL-180329]
  - drm/nouveau: fix nvkm_device leak on aperture removal failure (Anusha Srivatsa) [RHEL-180329]
  - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Anusha Srivatsa) [RHEL-180329]
  - drm/amdgpu: replace PASID IDR with XArray (Anusha Srivatsa) [RHEL-180329]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-734.el9]
changelog:
  - redhat/configs: disable CONFIG_SMB_KUNIT_TESTS (Paulo Alcantara) [RHEL-216926]
  - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-216926]
  - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-216926]
  - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-216926]
  - cifs: validate idmap key payload length (Paulo Alcantara) [RHEL-216926]
  - smb: client: remove conditional return with no effect (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix buffer leaks in SMB1 read and write (Paulo Alcantara) [RHEL-216926]
  - smb: client: use GFP_KERNEL for registry allocation (Paulo Alcantara) [RHEL-216926]
  - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-216926]
  - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-216926]
  - smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target (Paulo Alcantara) [RHEL-216926]
  - smb: client: bound dirent name against end of SMB response in cifs_filldir (Paulo Alcantara) [RHEL-216926]
  - smb: client: validate DFS referral PathConsumed (Paulo Alcantara) [RHEL-216926]
  - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-216926]
  - smb: client: reject overlapping data areas in SMB2 responses (Paulo Alcantara) [RHEL-216926]
  - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-216926]
  - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-216926]
  - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-216926]
  - smb/client: handle overlapping allocated ranges in fallocate (Paulo Alcantara) [RHEL-216926]
  - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-216926]
  - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-216926]
  - smb: client: mask server-provided mode to 07777 in modefromsid (Paulo Alcantara) [RHEL-216926]
  - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-216926]
  - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-216926]
  - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-216926]
  - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix overflow in passthrough ioctl bounds check (Paulo Alcantara) [RHEL-216926]
  - cifs: Fix support for creating SFU fifo (Paulo Alcantara) [RHEL-216926]
  - cifs: Fix support for creating SFU socket (Paulo Alcantara) [RHEL-216926]
  - cifs: validate DFS referral string offsets (Paulo Alcantara) [RHEL-216926]
  - smb: client: use GFP_KERNEL for DFS cache allocations (Paulo Alcantara) [RHEL-216926]
  - smb: client: restrict implied bcc[0] exemption to responses without data area (Paulo Alcantara) [RHEL-216926]
  - smb: client: preserve leading slash for POSIX absolute symlink targets (Paulo Alcantara) [RHEL-216926]
  - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-216926]
  - smb: client: use unaligned reads in parse_posix_ctxt() (Paulo Alcantara) [RHEL-216926]
  - smb: client: harden POSIX SID length parsing (Paulo Alcantara) [RHEL-216926]
  - cifs: define variable sized buffer for querydir responses (Paulo Alcantara) [RHEL-216926]
  - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-216926]
  - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-216926]
  - smb: client: Fix next buffer leak in receive_encrypted_standard() (Paulo Alcantara) [RHEL-216926]
  - smb/client: use %pe to print error pointer (Paulo Alcantara) [RHEL-216926]
  - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-216926]
  - smb common: add missing AAPL defines (Paulo Alcantara) [RHEL-216926]
  - smb/client: fix chown/chgrp with SMB3 POSIX Extensions (Paulo Alcantara) [RHEL-216926]
  - smb/client: fix security flag calculation when setting security descriptors (Paulo Alcantara) [RHEL-216926]
  - smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl() (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix query directory replay double-free (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix change notify replay double-free (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix query_info() replay double-free (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix double-free in SMB2_ioctl() replay (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix double-free in SMB2_open() replay (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix double-free in SMB2_flush() replay (Paulo Alcantara) [RHEL-216926]
  - smb: move compression definitions into common/fscc.h (Paulo Alcantara) [RHEL-216926]
  - smb: client: Use more common code in SMB2_tcon() (Paulo Alcantara) [RHEL-216926]
  - smb: client: Use more common error handling code in smb3_reconfigure() (Paulo Alcantara) [RHEL-216926]
  - smb/client: clean up a type issue in cifs_xattr_get() (Paulo Alcantara) [RHEL-216926]
  - smb/client: allow FS_IOC_SETFLAGS to clear compression (Paulo Alcantara) [RHEL-216926]
  - smb/client: use writable handle for FS_IOC_SETFLAGS compression (Paulo Alcantara) [RHEL-216926]
  - smb/client: always return a value for FS_IOC_GETFLAGS (Paulo Alcantara) [RHEL-216926]
  - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-216926]
  - cifs: validate full SID length in security descriptors (Paulo Alcantara) [RHEL-216926]
  - smb: client: resolve SWN tcon from live registrations (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix conflicting option validation for new mount API (Paulo Alcantara) [RHEL-216926]
  - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-216926]
  - smb: client: convert cifs_smb3_do_mount() to sget_fc() (Paulo Alcantara) [RHEL-216926]
  - smb: client: change allocation requirements in DUP_CTX_STR macro (Paulo Alcantara) [RHEL-216926]
  - smb: client: require net admin for CIFS SWN netlink (Paulo Alcantara) [RHEL-216926]
  - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (Paulo Alcantara) [RHEL-216926]
  - smb: client: avoid integer overflow in SMB2 READ length check (Paulo Alcantara) [RHEL-216926]
  - cifs: client: stage smb3_reconfigure() updates and restore ctx on failure (Paulo Alcantara) [RHEL-216926]
  - smb/client: fix possible infinite loop and oob read in symlink_data() (Paulo Alcantara) [RHEL-216926]
  - SMB3.1.1: add missing QUERY_DIR info levels (Paulo Alcantara) [RHEL-216926]
  - smb/client: fix out-of-bounds read in symlink_data() (Paulo Alcantara) [RHEL-216926]
  - smb: client: Zero-pad short GSS session keys per MS-SMB2 (Paulo Alcantara) [RHEL-216926]
  - smb: client: Use FullSessionKey for AES-256 encryption key derivation (Paulo Alcantara) [RHEL-216926]
  - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-216926]
  - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-216926]
  - smb: client: change allocation requirements in smb2_compound_op (Paulo Alcantara) [RHEL-216926]
  - smb/client: remove unused smb3_parse_opt() (Paulo Alcantara) [RHEL-216926]
  - smb: common: add SMB3_COMPRESS_MAX_ALGS (Paulo Alcantara) [RHEL-216926]
  - smb: client: compress: add code docs to lz77.c (Paulo Alcantara) [RHEL-216926]
  - smb: client: compress: LZ77 optimizations (Paulo Alcantara) [RHEL-216926]
  - smb: client: compress: increase LZ77_MATCH_MAX_DIST (Paulo Alcantara) [RHEL-216926]
  - smb: client: compress: fix counting in LZ77 match finding (Paulo Alcantara) [RHEL-216926]
  - smb: client: compress: fix buffer overrun in lz77_compress() (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix (remove) drop_dir_cache module parameter (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Paulo Alcantara) [RHEL-216926]
  - smb: client: compress: fix bad encoding on last LZ77 flag (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix integer underflow in receive_encrypted_read() (Paulo Alcantara) [RHEL-216926]
  - smb: client: add tracepoints for deferred handle caching (Paulo Alcantara) [RHEL-216926]
  - smb: client: add oplock level to smb3_open_done tracepoint (Paulo Alcantara) [RHEL-216926]
  - smb: client: add tracepoint for local lock conflicts (Paulo Alcantara) [RHEL-216926]
  - smb: client: add tracepoints for lock operations (Paulo Alcantara) [RHEL-216926]
  - smb: client: allow both 'lease' and 'nolease' mount options (Paulo Alcantara) [RHEL-216926]
  - smb: move filesystem_vol_info into common/fscc.h (Paulo Alcantara) [RHEL-216926]
  - smb: move file_basic_info into common/fscc.h (Paulo Alcantara) [RHEL-216926]
  - smb: move some definitions from common/smb2pdu.h into common/fscc.h (Paulo Alcantara) [RHEL-216926]
  - vfs: get rid of BUG_ON() in d_mark_tmpfile_name() (Paulo Alcantara) [RHEL-216926]
  - smb: client: get rid of d_drop()+d_add() (Paulo Alcantara) [RHEL-216926]
  - smb: client: set ATTR_TEMPORARY with O_TMPFILE | O_EXCL (Paulo Alcantara) [RHEL-216926]
  - smb: client: add support for O_TMPFILE (Paulo Alcantara) [RHEL-216926]
  - vfs: introduce d_mark_tmpfile_name() (Paulo Alcantara) [RHEL-216926]
  - smb: client: add missing MODULE_DESCRIPTION() to smb1maperror_test (Paulo Alcantara) [RHEL-216926]
  - smb: client: Remove unnecessary selection of CRYPTO_ECB (Paulo Alcantara) [RHEL-216926]
  - smb/client: move smb2maperror declarations to smb2proto.h (Paulo Alcantara) [RHEL-216926]
  - smb/client: introduce KUnit tests to check DOS/SRV err mapping search (Paulo Alcantara) [RHEL-216926]
  - smb/client: check if SMB1 DOS/SRV error mapping arrays are sorted (Paulo Alcantara) [RHEL-216926]
  - smb/client: use binary search for SMB1 DOS/SRV error mapping (Paulo Alcantara) [RHEL-216926]
  - smb/client: autogenerate SMB1 DOS/SRV to POSIX error mapping (Paulo Alcantara) [RHEL-216926]
  - smb/client: annotate smberr.h with POSIX error codes (Paulo Alcantara) [RHEL-216926]
  - smb/client: move ERRnetlogonNotStarted to DOS error class (Paulo Alcantara) [RHEL-216926]
  - smb/client: introduce KUnit test to check ntstatus_to_dos_map search (Paulo Alcantara) [RHEL-216926]
  - smb/client: check if ntstatus_to_dos_map is sorted (Paulo Alcantara) [RHEL-216926]
  - smb/client: use binary search for NT status to DOS mapping (Paulo Alcantara) [RHEL-216926]
  - smb/client: refactor ntstatus_to_dos() to return mapping entry (Paulo Alcantara) [RHEL-216926]
  - smb/client: replace nt_errs with ntstatus_to_dos_map (Paulo Alcantara) [RHEL-216926]
  - smb/client: autogenerate SMB1 NT status to DOS error mapping (Paulo Alcantara) [RHEL-216926]
  - smb/client: annotate nterr.h with DOS error codes (Paulo Alcantara) [RHEL-216926]
  - smb/client: avoid null-ptr-deref when tests fail in test_cmp_map() (Paulo Alcantara) [RHEL-216926]
  - fs/smb/client: add verbose error logging for UNC parsing (Paulo Alcantara) [RHEL-216926]
  - smb/client: ensure smb2_mapping_table rebuild on cmd changes (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-216926]
  - cifs: smb1: fix comment typo (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix iface port assignment in parse_server_interfaces (Paulo Alcantara) [RHEL-216926]
  - smb/client: only export symbol for 'smb2maperror-test' module (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-216926]
  - smb/client: make SMB2 maperror KUnit tests a separate module (Paulo Alcantara) [RHEL-216926]
  - smb: client: Use snprintf in cifs_set_cifscreds (Paulo Alcantara) [RHEL-216926]
  - smb: client: Don't log plaintext credentials in cifs_set_cifscreds (Paulo Alcantara) [RHEL-216926]
  - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-216926]
  - smb: client: fix cifs_pick_channel when channels are equally loaded (Paulo Alcantara) [RHEL-216926]
  - smb: client: terminate session upon failed client required signing (Paulo Alcantara) [RHEL-216926]
  - smb/client: move NT_STATUS_MORE_ENTRIES (Paulo Alcantara) [RHEL-216926]
  - smb/client: rename to NT_ERROR_INVALID_DATATYPE (Paulo Alcantara) [RHEL-216926]
  - smb/client: rename to NT_STATUS_SOME_NOT_MAPPED (Paulo Alcantara) [RHEL-216926]
  - smb/client: map NT_STATUS_PRIVILEGE_NOT_HELD (Paulo Alcantara) [RHEL-216926]
  - smb/client: map NT_STATUS_MORE_PROCESSING_REQUIRED (Paulo Alcantara) [RHEL-216926]
  - smb/client: map NT_STATUS_BUFFER_OVERFLOW (Paulo Alcantara) [RHEL-216926]
  - smb/client: map NT_STATUS_NOTIFY_ENUM_DIR (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Remove duplicate include of cifs_debug.h (Paulo Alcantara) [RHEL-216926]
  - smb client: Add generated file to gitignore file (Paulo Alcantara) [RHEL-216926]
  - cifs: Fix the copyright banner on smb1maperror.c (Paulo Alcantara) [RHEL-216926]
  - smb: common: add header guards to fs/smb/common/smb2status.h (Paulo Alcantara) [RHEL-216926]
  - smb: client: Avoid a dozen -Wflex-array-member-not-at-end warnings (Paulo Alcantara) [RHEL-216926]
  - smb/client: remove useless comment in mapping_table_ERRSRV (Paulo Alcantara) [RHEL-216926]
  - smb/client: remove some literal NT error codes from ntstatus_to_dos_map (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_VOLUME_NOT_UPGRADED (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_NO_USER_KEYS (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_WRONG_EFS (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_NO_EFS (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_NO_RECOVERY_POLICY (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_RANGE_NOT_FOUND (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_DECRYPTION_FAILED (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_ENCRYPTION_FAILED (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_DIRECTORY_IS_A_REPARSE_POINT (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_VOLUME_DISMOUNTED (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_VARIABLE_NOT_FOUND (Paulo Alcantara) [RHEL-216926]
  - smb/client: rename ERRinvlevel to ERRunknownlevel (Paulo Alcantara) [RHEL-216926]
  - smb/client: add NT_STATUS_OS2_INVALID_LEVEL (Paulo Alcantara) [RHEL-216926]
  - smb/client: map NT_STATUS_INVALID_INFO_CLASS to ERRbadpipe (Paulo Alcantara) [RHEL-216926]
  - smb/client: introduce KUnit test to check search result of smb2_error_map_table (Paulo Alcantara) [RHEL-216926]
  - smb/client: use bsearch() to find target in smb2_error_map_table (Paulo Alcantara) [RHEL-216926]
  - smb/client: check whether smb2_error_map_table is sorted in ascending order (Paulo Alcantara) [RHEL-216926]
  - cifs: Autogenerate SMB2 error mapping table (Paulo Alcantara) [RHEL-216926]
  - smb: client: correct value for smbd_max_fragmented_recv_size (Paulo Alcantara) [RHEL-216926]
  - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-216926]
  - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-216926]
  - cifs: Label SMB2 statuses with errors (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Make BCC accessors conditional (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: connect.c (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: sess.c (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: cifsencrypt.c (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: netmisc.c (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: misc.c (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: cifs_debug.c (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Move inline funcs (Paulo Alcantara) [RHEL-216926]
  - cifs: Fix cifs_dump_mids() to call ->dump_detail (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Don't return smb_hdr from cifs_{,small_}buf_get() (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Move BCC access functions (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Adjust #includes (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Split SMB1 protocol defs into smb1pdu.h (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Add some #includes (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Move some SMB1 received PDU checking bits to smb1transport.c (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Move some SMB1 receive bits to smb1transport.c (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Create smb1proto.h for SMB1 declarations (Paulo Alcantara) [RHEL-216926]
  - cifs: SMB1 split: Rename cifstransport.c (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/ntlmssp.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/reparse.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/smb2proto.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/cifs_debug.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/cifs_swn.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/compress.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/cifs_spnego.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/fs_context.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/dns_resolve.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/dfs_cache.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/netlink.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/cifs_unicode.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/dfs.h (Paulo Alcantara) [RHEL-216926]
  - cifs: Scripted clean up fs/smb/client/cached_dir.h (Paulo Alcantara) [RHEL-216926]
  - smb: client: introduce multichannel async work during mount (Paulo Alcantara) [RHEL-216926]
  - cifs: on replayable errors back-off before replay, not after (Paulo Alcantara) [RHEL-216926]
  - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-207773]
  - rtla: Stop the record trace on interrupt (Tomas Glozar) [RHEL-207773]
  - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213219] {CVE-2026-63888}
  - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212062]
  - ice: implement E825 TX ref clock control and TXC hardware sync status (Michal Schmidt) [RHEL-193816]
  - ice: add Tx reference clock index handling to AN restart command (Michal Schmidt) [RHEL-193816]
  - ice: implement CPI support for E825C (Michal Schmidt) [RHEL-193816]
  - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Michal Schmidt) [RHEL-193816]
  - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193044]
  - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188795] {CVE-2025-54518}
  - redhat: sign UKI's inner vmlinuz with modules signing key (Vitaly Kuznetsov) [RHEL-223629]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-735.el9]
changelog:
  - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222498] {CVE-2026-64531}
  - hung_task: explicitly report I/O wait state in log output (Luiz Capitulino) [RHEL-146503]
  - hung_task: ignore hung_task_warnings when hung_task_panic is enabled (Luiz Capitulino) [RHEL-146503]
  - hung_task: print message when hung_task_warnings gets down to zero. (Luiz Capitulino) [RHEL-146503]
  - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-212733]
  - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-212733]
  - wifi: nl80211: re-check wiphy netns in testmode and vendor dump continuations (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - dt-bindings: wireless: ath10k: Add quirk to skip host cap QMI requests (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: fix typo rx_freq_frome_ie (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: fix resource leak in probe error path (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: correct drop logic for malformed AMPDU frames (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtl818x: drop redundant device reference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath6kl: rename disconnect callback (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath6kl: drop redundant device reference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: enforce HE/EHT cap/oper consistency (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: fix leak if split 6 GHz scanning fails (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mvm: avoid oversized UATS command copy (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: send tx power constraints before link activation (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: wext: validate chandef in monitor mode (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: consume only present negotiated TTLM maps (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: wilc1000: fix dma_buffer leak on bus acquire failure (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: don't override max_amsdu_subframes (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only parsing (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath11k: clear shared SRNG pointer state on restart (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: disconnect only after 6 beacons without Rx (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o BSS vif (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: use correct function to read STEP_URM register (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: stop TX during firmware restart (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath10k: skip WMI and beacon transmission when device is wedged (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath11k: fix error path leaks in some WMI calls (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath11k: fix error path leaks in some WMI WOW calls (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: re-check wiphy netns in nl80211_prepare_wdev_dump() continuation (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: require CAP_NET_ADMIN over the target netns in SET_WIPHY_NETNS (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: initialize RSSI dBm conversion event state (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: tests: mark HT check strict (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (Jose Ignacio Tornos Martinez) [RHEL-186475] {CVE-2026-46180}
  - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: fix OF node refcount imbalance in WSI graph traversal (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - net: use get_random_u{16,32,64}() where appropriate [wireless] (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: Explicitly include <linux/export.h> in michael-mic.c (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath10k: Add device-tree quirk to skip host cap QMI requests (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Use michael_mic() from cfg80211 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath11k: Use michael_mic() from cfg80211 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Enable IPQ5424 WiFi device support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Add CE remap hardware parameters for IPQ5424 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: add ath12k_hw_regs for IPQ5424 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: add ath12k_hw_version_map entry for IPQ5424 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Add ath12k_hw_params for IPQ5424 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Create symlink for each radio in a wiphy (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Skip adding inactive partner vdev info (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Support channel change stats (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Rename hw_link_id to radio_idx in ath12k_ah_to_ar() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: enable MLO support for 4-address mode interfaces (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: use ap_addr for 4-address NULL frame destination (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: synchronize valid links for WDS AP_VLAN interfaces (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: remove unused variables in minstrel_ht_alloc_sta (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: brcmfmac: silence warning for non-existent, optional firmware (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: wilc1000: use kzalloc_flex (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: brcmfmac: of: defer probe for MAC address (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: brcmfmac: Fix error pointer dereference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: allow add_key on NAN interfaces (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: report and drop spurious NAN Data frames (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: allow block ack agreements in NAN Data (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: Accept frames on NAN DATA interfaces (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: add support for TX over NAN_DATA interfaces (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: update NAN data path state on schedule changes (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: add NAN peer schedule support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: support NAN stations (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: handle reconfig for NAN DATA interfaces (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: support open and close for NAN_DATA interfaces (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: add NAN local schedule support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: run NAN DE code only when appropriate (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: export ieee80211_calculate_rx_timestamp (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ieee80211: add more NAN definitions (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: add a TXQ for management frames on NAN devices (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: Add support for Elecom WDC-XE2402TU3-B (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add PCI ID of RTL8922DE and RTL8922DE-VS (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add chip_info and chip_ops struct (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add ops related to BT coexistence mechanism (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add RF ops of init hardware and get thermal (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: configure TX/RX path assisting in BT coexistence (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add set TX power callback (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add RF calibration ops (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add set channel with pre-/post- helpers (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: BB hardware pre-/post-init, TX/RX path and power settings (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: fix typo "frome" -> "from" in rx_freq_frome_ie (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: Fill fw_version member of struct wiphy (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw88: Fill fw_version member of struct wiphy (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw88: coex: Ignore BT info byte 5 from RTL8821A (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: fw: load TX power elements according to AID (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: phy: load RF parameters relying on ACV for RTL8922D (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: phy: expand PHY page for RTL8922D (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: mac: disable pre-load function for RTL8922DE (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: mac: add specific case to dump mac memory for RTL8922D (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: pci: clear SER ISR when initial and leaving WoWLAN for WiFi 7 chips (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: wow: enable MLD address for Magic packet wakeup (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: wow: use struct style to fill WOW wakeup control H2C command (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add set channel of RF part (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add set channel of BB part (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add set channel of MAC part (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: read and configure RF by calibration data from efuse physical map (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: define efuse map and read necessary fields (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add power on/off functions (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8922d: add definition of quota, registers and efuse block (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw88: validate RX rate to prevent out-of-bound (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: Add support for Buffalo WI-U3-2400XE2 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: Add support for TP-Link Archer TX50U (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: retry efuse physical map dump on transient failure (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw88: TX QOS Null data the same way as Null data (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw88: add quirks to disable PCI ASPM and deep LPS for HP P3S95EA#ACB (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - net: qrtr: fix endian handling of confirm_rx field (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: ignore reserved bits in reconfiguration status (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: allow protected action frame TX for NAN (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ieee80211: Add some missing NAN definitions (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: Add a notification to notify NAN channel evacuation (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: add NL80211_CMD_NAN_ULW_UPDATE notification (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: allow reporting spurious NAN Data frames (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: allow ToDS=0/FromDS=0 data frames on NAN data interfaces (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: define an API for configuring the NAN peer's schedule (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: add support for NAN stations (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: separately store HT, VHT and HE capabilities for NAN (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: add support for NAN data interface (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: make sure NAN chandefs are valid (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: Add an API to configure local NAN schedule (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: cleanup error path of ieee80211_do_open (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: extract channel logic from link logic (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: set RX_FLAG_RADIOTAP_TLV_AT_END generically (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: reduce the number of prints upon firmware crash (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: fix the description of SESSION_PROTECTION_CMD (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: introduce iwl_mld_vif_fw_id_valid (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: block EMLSR during TDLS connections (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: TLC_MNG_CONFIG_CMD can use several structures (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: update the TLC when we deactivate a link (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: add a macro for max FW links (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: always assign a fw id to a vif (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: use the dedicated helper to extract a link (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: add MAC context command version 4 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: handle NULL/ERR returns from ptp_clock_register() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: add double-include guards to nan.h (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: make alloc functions not forced static (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: rename iwl_mld_phy_from_mac80211() argument (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: remove type argument from iwl_mld_add_sta() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: make iwl_mld_mac80211_iftype_to_fw() static (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: pcie: don't dump on reset handshake in dump (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: use IWL_FW_CHECK for sync timeout (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: add BIOS revision compatibility check for PPAG command (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: validate the channels received in iwl_mcc_update_resp_v* (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: add CQM event support for per-link RSSI changes (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: eliminate duplicate WIDE_ID in PPAG command handling (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: fw: Add TLV support for BIOS revision of command (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: bump core version for BZ/SC/DR (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: support changing iftype at runtime (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: set UHR MCS in RX status (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: enable UHR in TLC (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: remove SCAN_TIMEOUT_MSEC (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: remove IWL_MAX_WD_TIMEOUT (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: uefi: mode the comments valid kerneldoc comments (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: support PER_CHAIN_LIMIT_OFFSET_CMD v6 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: acpi: add support for WGDS revision 4 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: acpi: validate the WGDS table (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: uefi: add support for WGDS rev4 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: uefi: open code the parsing of the WGDS table (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: support version 11 of REDUCE_TX_POWER_CMD (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: acpi: add support for EWRD rev 3 table (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: acpi: add support for WRDS rev 3 table (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: uefi: support the new WRDS and EWRD tables (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mvm: zero iwl_geo_tx_power_profiles_cmd before sending (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: restrict TOP reset to some devices (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: uefi: add support for PPAG table rev5 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: acpi: add support for PPAG rev5 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: acpi: check the size of the ACPI PPAG tables (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: regulatory: support a new command for PPAG (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: add support for sta command version 3 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: bring iwl_fill_ppag_table to the iwlmvm (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: uefi: open code the PPAG table store operation (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: Introduce scan command version 18 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: Refactor scan command handling (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: remove unused scan expire time constants (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mvm: cleanup some more MLO code (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: acpi: better use ARRAY_SIZE than a define (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: uefi: decouple UEFI and firmware APIs (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: ensure we don't read SAR values past the limit (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: mvm: replace use of system_wq with system_percpu_wq (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: fw: replace use of system_unbound_wq with system_dfl_wq (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: iwlwifi: replace use of system_unbound_wq with system_dfl_wq (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Destroy active sta links in mt7996_mac_sta_remove() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Add mcu APIs to enable/disable vif links. (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Destroy vif active links in mt7996_remove_interface() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Move mlink deallocation in mt7996_vif_link_remove() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Account active links in valid_links fields (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Rely on msta_link link_id in mt7996_vif_link_remove() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: fix frequency separation for station STR mode (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: host-only unwind published links on add failure (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: publish msta->link after successful link add (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: switch link STA allocation to RCU lifetime (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: move WCID teardown into link_sta_remove() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: drop WCID reinit after publish (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: unwind WCID setup on link STA add failure (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: make WCID cleanup unconditional in sta_remove_links() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: pass mconf and mlink to wtbl_update_hdr_trans() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: resolve link after acquiring mt76 mutex (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: pass mlink to set_link_key() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: pass mlink to wtbl_update_hdr_trans() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: validate mlink in sta_hdr_trans_tlv() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: pass mlink to sta_hdr_trans_tlv() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: pass mlink to mac_link_sta_remove() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: resolve primary mlink via def_wcid (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: pass mlink to mcu_sta_update() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: pass mlink and mconf to sta_mld_tlv() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: pass WCID indices to bss_basic_tlv() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: pass mlink to sta_amsdu_tlv() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: fix issues with manually triggered radar detection (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: adjust timeout value for boot-up calibration commands (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: update WFSYS reset flow for MT7990 chipsets (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: support critical packet mode for MT7990 chipsets (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: add per-link beacon monitoring for MLO (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: wait for firmware TX completion of mgmt frames before channel switch (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: route nullfunc frames to PSD/ALTX queue (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: flush pending TX before channel switch (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: send nullfunc PS frames on offchannel transitions (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: optimize ROC for same-channel case (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: abort ROC on chanctx changes (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: check chanctx before restoring channel after ROC (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: add offchannel check to mt76_roc_complete (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: support upgrading passive scans to active (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: fix multi-radio on-channel scanning (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Decrement sta counter removing the link in mt7996_mac_reset_sta_iter() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Remove unnecessary phy filed in mt7996_vif_link struct (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Remove link pointer dependency in mt7996_mac_sta_remove_links() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Add missing CHANCTX_STA_CSA property (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: fix incorrect TLV length in CLC command (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: add missing lock protection in mt76_sta_state for sta_event callback (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: fix 6GHz regulatory update on connection (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Disable Rx hdr_trans in monitor mode (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Add eMLSR support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: don't return TXQ when exceeding max non-AQL packets (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: fix queue pause after scan due to wrong channel switch reason (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: avoid to set ACK for MCU command if wait_resp is not set (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXP (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: add MT7902 SDIO device support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: add MT7902 PCIe device support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt792x: add MT7902 WFDMA prefetch configuration (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: add MT7902 MCU support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt792x: ensure MCU ready before ROM patch download (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt792x: add PSE handling barrier for the large MCU cmd (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: connac: mark MT7902 as hw txp devices (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: add MT7902e DMA layout support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: handle MT7902 irq_map quirk with mutable copy (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: use mt76_for_each_q_rx() in reset path (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: connac: use is_connac2() to replace is_mt7921() checks (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: apply calibration-free data from OTP (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: add variant for MT7992 chipsets (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: add external EEPROM support for mt799x chipsets (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: don't consider the sband when processing capabilities (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: properly handle error in ieee80211_add_virtual_monitor (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: support UNII-9 channels in ieee80211_channel_to_freq_khz (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: make ieee80211_find_chanctx link-unaware (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211_hwsim: advertise basic UHR support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: use for_each_chanctx_user_* in one more place (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: Add support for additional 7 GHz channels (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: Replace strncpy() with strscpy_pad() in drv_switch_vif_chanctx tracepoint (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: fix backoff fields and max_power calculation (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: Replace deprecated PCI function (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: increase txq memory limit to 32 MiB (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: reset device after MCU message timeout (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: fix deadlock in remain-on-channel (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: fix tx power setting failure after chip reset (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: Skip scan process during suspend. (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: drop puncturing handling from BSS change path (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: Fix memory leak destroying device (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: fix a potential clc buffer length underflow (Jose Ignacio Tornos Martinez) [RHEL-186475] {CVE-2026-46136}
  - wifi: mt76: mt7921: Place upper limit on station AID (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: fix list corruption in mt76_wcid_cleanup (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: fix incorrect length field in txpower command (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: add support for ERP CTS & HT protection (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7915: fix use_cts_prot support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7615: fix use_cts_prot support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt7601u: check multiple firmware paths (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Reset ampdu_state state in case of failure in mt7996_tx_check_aggr() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Switch to the secondary link if the default one is removed (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Reset mtxq->idx if primary link is removed in mt7996_vif_link_remove() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: Set mtxq->wcid just for primary link (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: introduce CSA support in non-MLO mode (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt76x02: wake queues after reconfig (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: fix iface combination for different chipsets (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: add duplicated WTBL command (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: offload radar threshold initialization (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: abort CCA when CSA is starting (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel switch (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: fix the behavior of radar detection (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7996: extend CSA and CCA support for MLO (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: use int for band coming from netlink (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: fix STA link removal during link removal (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: usb: Rx aggregation for RTL8832CU/RTL8851BU (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Remove unused DFS Unit Test definitions (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Clean up the WMI Unit Test command interface (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: debug: simulate Wi-Fi 7 SER L0/L1 without PS mode (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: Recalculate station aggregates when AMSDU length changes for MLO links (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: Drop malformed AMPDU frames with abnormal PN (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: replace RF mutex with wiphy lock assertion (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: wow: add retry for ensuring packet are processed (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: chan: recalc MLO DBCC mode based on current entity mode (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: chan: simplify link handling related to ROC (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: tweak settings of TX power and channel for Wi-Fi 7 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: move disabling dynamic mechanism functions to core (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: phy: limit AMPDU number for RA try rate (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: mac: remove A-die off setting for RTL8852C and RTL8922A (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: pci: update SER parameters for suspend/resume (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtlwifi: rtl8192d: fix typo in H2C wait counter names (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtlwifi: usb: drop redundant device reference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: drop redundant device reference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw88: fix device leak on probe failure (Jose Ignacio Tornos Martinez) [RHEL-186475] {CVE-2026-31604}
  - wifi: rtl8xxxu: drop redundant device reference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtl8xxxu: fix potential use of uninitialized value (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtl8xxxu: Mark RTL8188ETV (0bda:0179) as tested (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: reject S1G/60G with HT chantype (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ieee80211: fix definition of EHT-MCS 15 in MRU (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: check non-S1G width with S1G chandef (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: restrict cfg80211_chandef_create() to only HT-based bands (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: don't use cfg80211_chandef_create() for default chandef (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: Remove deleted sta links in ieee80211_ml_reconf_work() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: split control freq check from chandef check (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: always use full chanctx compatible check (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: refactor chandef tracing macros (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: validate HE 6 GHz operation when EHT is used (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: split out UHR operation information (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Use .mbn firmware for AHB devices (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath10k: rename disconnect callback (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath10k: drop redundant device reference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath9k: drop redundant device reference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Fix legacy rate mapping for monitor mode capture (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Fix the assignment of logical link index (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: account TX stats only when ACK/BA status is present (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mwifiex: drop redundant device reference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rt2x00: drop redundant device reference (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211_hwsim: add incumbent signal interference detection support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: Add SPDX ids to some files in the wireless subsystem (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: add support for NDP ADDBA/DELBA for S1G (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ieee80211: fix UHR operation DBE vs. P-EDCA order (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: remove AID bit stripping for print (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: remove stale TODO item (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: move action code from per-type frame structs (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: UHR: define DPS/DBE/P-EDCA elements and fix size parsing (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211_hwsim: change hwsim_class to a const struct (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: give the AP more time for EPPKE as well (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw88: check for PCI upstream bridge existence (Jose Ignacio Tornos Martinez) [RHEL-186475] {CVE-2026-46092}
  - wifi: rtw89: ser: post-recover DMAC state to prevent LPS (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: ser: Wi-Fi 7 reset HALT C2H after reading it (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: debug: add SER SW counters to count simulation (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: rfk: add hardware version to rtw89_fw_h2c_rf_pre_ntfy_mcc for new WiFi 7 firmware (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: add H2C command to protect TX/RX for unused PHY (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8851b: update supported firmware format to 1 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8852a: update supported firmware format to 1 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8852a: move DIG tables to rtw8852a.c (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: 8852b: update supported firmware format to 2 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: add general way to generate module firmware string (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: fw: recognize firmware type B by AID (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: fw: add fw_def struct to put firmware name and format version (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw88: coex: Solve LE-HID lag & update coex version to 26020420 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rtw89: Turbo mode for RTL8851BU/RTL8852BU (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Remove the unused argument from the Rx data path (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Enable monitor mode support on IPQ5332 (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: Set up MLO after SSR (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath11k: Silence remoteproc probe deferral prints (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: support key installation on non-netdev wdevs (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: make cluster id an array (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: update outdated comment (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: Advertise IEEE 802.1X authentication support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: Add support for IEEE 802.1X authentication protocol in non-AP STA mode (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: add support for IEEE 802.1X Authentication Protocol (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: Advertise EPPKE support based on driver capabilities (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211_hwsim: Advertise support for (Re)Association frame encryption (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: Fix AAD/Nonce computation for management frames with MLO (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: rt2x00: use generic nvmem_cell_get (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: fetch unsolicited probe response template by link ID (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: fetch FILS discovery template by link ID (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: don't allow DFS channels for NAN (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: refactor wiphy_suspend (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211/cfg80211: support stations of non-netdev interfaces (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: remove unneeded call to cfg80211_leave (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: nl80211: refactor nl80211_parse_chandef (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: Set link ID for NULL packets sent to probe stations (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mac80211: set band information only for non-MLD when probing stations using NULL frame (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-186475] {CVE-2026-46069}
  - wifi: mac80211_hwsim: background CAC support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: events, report background radar (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: set and report chandef CAC ongoing (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: cfg80211: fix background CAC (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath11k: fix memory leaks in beacon template setup (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: add basic hwmon temperature reporting (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath12k: fix indentation in ath12k_qmi_aux_uc_load() (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: ath9k: Fix typo (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: disable auto regd changes after user set (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: add auto regdomain switch support (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: improve EHT capability control in regulatory flow (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: refactor regulatory notifier flow (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: refactor CLC support check flow (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: refactor regulatory domain handling to regd.[ch] (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - wifi: mt76: mt7925: add rfkill_poll for hardware rfkill (Jose Ignacio Tornos Martinez) [RHEL-186475]
  - bus: mhi: host: pci_generic: Add Telit FE912C04 modem support (Jose Ignacio Tornos Martinez) [RHEL-186474]
  - bus: mhi: ep: Test for non-zero return value where applicable (Jose Ignacio Tornos Martinez) [RHEL-186474]
  - bus: mhi: host: pci_generic: Add pm_runtime_forbid() in remove callback (Jose Ignacio Tornos Martinez) [RHEL-186474]
  - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (Jose Ignacio Tornos Martinez) [RHEL-186474]
  - bus: mhi: host: pci_generic: Add NMEA channels to FN920C04 and FN990A (Jose Ignacio Tornos Martinez) [RHEL-186474]
  - bus: mhi: host: pci_generic: Enable IP_SW and IP_ETH channels for Qcom QDU100 device (Jose Ignacio Tornos Martinez) [RHEL-186474]
  - bus: mhi: host: pci_generic: Add Qualcomm SDX35 modem (Jose Ignacio Tornos Martinez) [RHEL-186474]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-736.el9]
changelog:
  - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-222801]
  - i2c: core: fix adapter deregistration race (David Arcari) [RHEL-222902] {CVE-2026-64279}
  - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183626] {CVE-2025-10263}
  - platform/x86/amd/hsmp: Clamp ioctl/send_message indices (Spectre v1) (David Arcari) [RHEL-217011]
  - pinctrl-amd: Don't clear S4 wake bits at probe (David Arcari) [RHEL-211144]
  - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (David Arcari) [RHEL-216442]
  - fs/resctrl: Fix use-after-free during unmount (David Arcari) [RHEL-216442]
  - fs/resctrl: Free mon_data structures on rdt_get_tree() failure (David Arcari) [RHEL-216442]
  - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (David Arcari) [RHEL-216442]
  - kernfs: fix suspicious RCU usage in kernfs_put() (David Arcari) [RHEL-216442]
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213339] {CVE-2026-63807}
  - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213339]
  - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213339]
  - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213339]
  - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-213339]
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211279] {CVE-2025-40026}
  - perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Charles Mirabile) [RHEL-121676]
  - perf/arm_cspmu: nvidia: Add revision id matching (Charles Mirabile) [RHEL-121676]
  - perf/arm_cspmu: Add pmpidr support (Charles Mirabile) [RHEL-121676]
  - perf/arm_cspmu: Add callback to reset filter config (Charles Mirabile) [RHEL-121676]
  - perf/arm_cspmu: Add PMEVFILT2R support (Charles Mirabile) [RHEL-121676]
  - perf/arm_cspmu: Fix missing io.h include (Charles Mirabile) [RHEL-121676]
  - perf/arm_cspmu: Generalise event filtering (Charles Mirabile) [RHEL-121676]
  - perf/arm_cspmu: Move register definitons to header (Charles Mirabile) [RHEL-121676]
  - fixup! Merge: s390/entry: Scrub r12 register on kernel entry (Jan Polensky) [RHEL-191803]
  - redhat/configs: Enable Epson RX8111 RTC driver (Nirmala Dalvi) [RHEL-184760]
  - rtc: rx8111: Adapt upstream driver for kernel 5.14 (Nirmala Dalvi) [RHEL-184760]
  - rtc: rx8111: handle VLOW flag (Nirmala Dalvi) [RHEL-184760]
  - rtc: rx8111: demote warnings to debug level (Nirmala Dalvi) [RHEL-184760]
  - rtc: Add driver for Epson RX8111 (Nirmala Dalvi) [RHEL-184760]
  - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188213] {CVE-2026-52923}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-737.el9]
changelog:
  - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-222675]
  - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224537]
  - thermal: intel: Fix dangling resources on thermal_throttle_online() failure (David Arcari) [RHEL-212721]
  - thermal: intel: int340x: Fix potential shift overflow in ptc_mmio_write() (David Arcari) [RHEL-212721]
  - bnxt_en: Fix NULL pointer dereference (CKI Backport Bot) [RHEL-185084]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-738.el9]
changelog:
  - scsi: smartpqi: Update version to 2.1.42-011 (Don Brace) [RHEL-224339]
  - scsi: smartpqi: Add new PCI device-ids (Don Brace) [RHEL-224339]
  - scsi: smartpqi: Add support for CCISS_BIG_PASSTHRU ioctl (Don Brace) [RHEL-224339]
  - scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. (Don Brace) [RHEL-224339]
  - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886}
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886}
  - platform/x86/intel/tpmi/plr: Prevent fault during unbind (Dennis Chen) [RHEL-212707]
  - platform/x86: intel: Add notifiers support (Dennis Chen) [RHEL-212707]
  - x86/fpu: Ensure XFD state on signal delivery (Dennis Chen) [RHEL-212652]
  - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery (Dennis Chen) [RHEL-212719]
  - ALSA: hda/realtek: Add quirk for TongFang X6SP45xU (Jaroslav Kysela) [RHEL-193254]
  - ASoC: amd: ps: disable MSI on resume in ACP PCI driver (Jaroslav Kysela) [RHEL-193254]
  - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (Jaroslav Kysela) [RHEL-193254]
  - ALSA: hda/tas2781: Cancel async firmware request at unbind (Jaroslav Kysela) [RHEL-193254]
  - firmware_loader: Add cancel helper for async requests (Jaroslav Kysela) [RHEL-193254]
  - ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (Jaroslav Kysela) [RHEL-193254]
  - ALSA: scarlett2: Allow selecting config_set by firmware version (Jaroslav Kysela) [RHEL-193254]
  - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: topology: fix memory leak in snd_sof_load_topology (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: topology: validate vendor array size before parsing (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: ipc4-control: Validate notification payload size (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (Jaroslav Kysela) [RHEL-193254]
  - ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280 (Jaroslav Kysela) [RHEL-193254]
  - ALSA: FCP: Fix NULL pointer dereference in interface lookup (Jaroslav Kysela) [RHEL-193254]
  - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SDCA: Validate written enum value in ge_put_enum_double() (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: qcom: clear opened when stream enable fails (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: qcom: reject stream disable with no active interface (Jaroslav Kysela) [RHEL-193254]
  - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: qcom: Free sideband sg_table objects (Jaroslav Kysela) [RHEL-193254]
  - soundwire: intel_ace2x: release bpt_stream when close it (Jaroslav Kysela) [RHEL-193254]
  - soundwire: fix bug in sdw_add_element_group_count found by syzkaller (Jaroslav Kysela) [RHEL-193254]
  - soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral (Jaroslav Kysela) [RHEL-193254]
  - mfd: cs42l43: Sanity check firmware size (Jaroslav Kysela) [RHEL-193254]
  - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (Jaroslav Kysela) [RHEL-193254]
  - ALSA: seq: avoid stale FIFO cells during resize (Jaroslav Kysela) [RHEL-193254]
  - ALSA: seq: oss: Serialize readq reset state with q->lock (Jaroslav Kysela) [RHEL-193254]
  - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (Jaroslav Kysela) [RHEL-193254]
  - ALSA: seq: Fix kernel heap address leak in bounce_error_event() (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: qcom: Guard sideband endpoint removal (Jaroslav Kysela) [RHEL-193254]
  - ASoC: topology: Check PCM and DAI name strings before use (Jaroslav Kysela) [RHEL-193254]
  - ASoC: tegra: tegra210_ahub: Validate written enum value (Jaroslav Kysela) [RHEL-193254]
  - ASoC: fsl: fsl_audmix: Validate written enum values (Jaroslav Kysela) [RHEL-193254]
  - ASoC: meson: aiu: Validate written enum values (Jaroslav Kysela) [RHEL-193254]
  - ASoC: codecs: hdac_hdmi: Validate written enum value (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly (Jaroslav Kysela) [RHEL-193254]
  - ASoC: SOF: Intel: select SND_SOC_SDW_UTILS=y from SND_SOC_SOF_HDA_GENERIC=y (Jaroslav Kysela) [RHEL-193254]
  - ASoC: cs35l56: Fix wrong error test on simple_write_to_buffer() (Jaroslav Kysela) [RHEL-193254]
  - ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (Jaroslav Kysela) [RHEL-193254]
  - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (Jaroslav Kysela) [RHEL-193254]
  - ASoC: codecs: aw88261: fix incorrect masks for boost regs (Jaroslav Kysela) [RHEL-193254]
  - ASoC: sma1307: Fix uevent string leaks in fault worker (Jaroslav Kysela) [RHEL-193254]
  - ALSA: aloop: Drop superfluous break (Jaroslav Kysela) [RHEL-193254]
  - ASoC: amd: acp-sdw-sof: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254]
  - ASoC: amd: acp-sdw-legacy: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254]
  - ALSA: seq: Clear variable event pointer on read (Jaroslav Kysela) [RHEL-193254]
  - ALSA: seq: Fix partial userptr event expansion (Jaroslav Kysela) [RHEL-193254]
  - ALSA: hda: fix Kconfig dependency of HD Audio PCI (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: qcom: Initialize offload control return value (Jaroslav Kysela) [RHEL-193254]
  - ALSA: seq: midi: Serialize output teardown with event_input (Jaroslav Kysela) [RHEL-193254]
  - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (Jaroslav Kysela) [RHEL-193254]
  - ALSA: xen-front: Connect event channel after stream prepare (Jaroslav Kysela) [RHEL-193254]
  - ALSA: xen-front: Reset event channel state on stream clear (Jaroslav Kysela) [RHEL-193254]
  - ASoC: dapm: Fix widget lookup with prefixed names across DAPM contexts (Jaroslav Kysela) [RHEL-193254]
  - ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7 (Jaroslav Kysela) [RHEL-193254]
  - ALSA: hda: Fix cached processing coefficient verbs (Jaroslav Kysela) [RHEL-193254]
  - ALSA: hda: conexant: Remove mic bias threshold override (Jaroslav Kysela) [RHEL-193254]
  - ALSA: hda/realtek: Add quirk for TongFang X6xx45xU (Jaroslav Kysela) [RHEL-193254]
  - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: Roll back quirk control caches on write errors (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (Jaroslav Kysela) [RHEL-193254]
  - ALSA: usb-audio: avoid kobject path lookup in DualSense match (Jaroslav Kysela) [RHEL-193254] {CVE-2026-64478}
  - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8 (Jaroslav Kysela) [RHEL-193254]
  - KVM: s390: Fall back to short-term pinning in MAP ioctl (Christoph Schlameuss) [RHEL-136457]
  - KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject (Christoph Schlameuss) [RHEL-136457]
  - KVM: s390: Enable adapter_indicators_set to use mapped pages (Christoph Schlameuss) [RHEL-136457]
  - KVM: s390: Add map/unmap ioctl and clean mappings post-guest (Christoph Schlameuss) [RHEL-136457]
  - KVM: s390: get rid of gmap_translate() (Christoph Schlameuss) [RHEL-136457]
  - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-150728]
  - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-150728]
  - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-150728]
  - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-150728]
  - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-150728]
  - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-150728] {CVE-2026-43084}
  - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-150728]
  - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-150728]
  - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Luis Claudio R. Goncalves) [RHEL-186591]
  - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188519] {CVE-2026-53000}
  - kernel.spec.template: add tcp_ao kselftests (Davide Caratti) [RHEL-142637]
  - Kconfig: enable CONFIG_TCP_AO (Davide Caratti) [RHEL-142637]
  - tcp: Decrement tcp_md5_needed static branch (Davide Caratti) [RHEL-142637]
  - net/tcp-ao: fix use-after-free of key in del_async path (Davide Caratti) [RHEL-142637]
  - sockptr: fix usize check in copy_struct_from_sockptr() for user pointers (Davide Caratti) [RHEL-142637]
  - tcp: defer md5sig_info kfree past RCU grace period in tcp_connect (Davide Caratti) [RHEL-142637]
  - tcp: restore RCU grace period in tcp_ao_destroy_sock (Davide Caratti) [RHEL-142637]
  - selftests/net: Synchronize client/server before counters checks (Davide Caratti) [RHEL-142637]
  - selftests/net: Fix various spelling mistakes in TCP-AO tests (Davide Caratti) [RHEL-142637]
  - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). (Davide Caratti) [RHEL-142637]
  - selftests/tcp_ao: Printing fixes to confirm with format-security (Davide Caratti) [RHEL-142637]
  - selftests/tcp_ao: Fix fscanf() call for format-security (Davide Caratti) [RHEL-142637]
  - selftests/tcp_ao: Zero-init tcp_ao_info_opt (Davide Caratti) [RHEL-142637]
  - selftests/net: Amend per-netns counter checks (Davide Caratti) [RHEL-142637]
  - selftests/tcp_ao: Make RST tests less flaky (Davide Caratti) [RHEL-142637]
  - selftests/net: Repair RST passive reset selftest (Davide Caratti) [RHEL-142637]
  - tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO. (Davide Caratti) [RHEL-142637]
  - tcp: Don't access uninit tcp_rsk(req)->ao_keyid in tcp_create_openreq_child(). (Davide Caratti) [RHEL-142637]
  - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Davide Caratti) [RHEL-142637] {CVE-2025-39852}
  - selftests/net: Rectify key counters checks (Davide Caratti) [RHEL-142637]
  - selftests/net: Argument value mismatch when calling verify_counters() (Davide Caratti) [RHEL-142637]
  - selftests: tcp_ao: set the timeout to 2 minutes (Davide Caratti) [RHEL-142637]
  - selftests: tcp_ao: add a config file (Davide Caratti) [RHEL-142637]
  - selftests/net/tcp-ao: Use LDLIBS instead of LDFLAGS (Davide Caratti) [RHEL-142637]
  - net/tcp_sigpool: Use kref_get_unless_zero() (Davide Caratti) [RHEL-142637]
  - selftest/tcp-ao: Rectify out-of-tree build (Davide Caratti) [RHEL-142637]
  - selftests/net: Add TCP-AO key-management test (Davide Caratti) [RHEL-142637]
  - selftests/net: Add TCP-AO selfconnect/simultaneous connect test (Davide Caratti) [RHEL-142637]
  - selftests/net: Add TCP-AO RST test (Davide Caratti) [RHEL-142637]
  - selftests/net: Add SEQ number extension test (Davide Caratti) [RHEL-142637]
  - selftests/net: Add TCP_REPAIR TCP-AO tests (Davide Caratti) [RHEL-142637]
  - selftests/net: Add test/benchmark for removing MKTs (Davide Caratti) [RHEL-142637]
  - selftests/net: Add TCP-AO + TCP-MD5 + no sign listen socket tests (Davide Caratti) [RHEL-142637]
  - selftests/net: Add test for TCP-AO add setsockopt() command (Davide Caratti) [RHEL-142637]
  - selftests/net: Add a test for TCP-AO keys matching (Davide Caratti) [RHEL-142637]
  - selftests/net: Add TCP-AO ICMPs accept test (Davide Caratti) [RHEL-142637]
  - selftests/net: Verify that TCP-AO complies with ignoring ICMPs (Davide Caratti) [RHEL-142637]
  - selftests/net: Add TCP-AO library (Davide Caratti) [RHEL-142637]
  - net/tcp-ao: Fix MAC comparison to be constant-time (Davide Caratti) [RHEL-142637] {CVE-2026-43384}
  - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Davide Caratti) [RHEL-142637] {CVE-2025-39950}
  - tcp: Free TCP-AO/TCP-MD5 info/keys without RCU (Davide Caratti) [RHEL-142637]
  - tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct() (Davide Caratti) [RHEL-142637]
  - net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals (Davide Caratti) [RHEL-142637]
  - net/tcp: Disable TCP-AO static key after RCU grace period (Davide Caratti) [RHEL-142637] {CVE-2024-43887}
  - net/tcp_ao: Don't leak ao_info on error-path (Davide Caratti) [RHEL-142637] {CVE-2024-40985}
  - Documentation/tcp-ao: Add a few lines on tracepoints (Davide Caratti) [RHEL-142637]
  - net/tcp: Remove tcp_hash_fail() (Davide Caratti) [RHEL-142637]
  - net/tcp: Add tcp-md5 and tcp-ao tracepoints (Davide Caratti) [RHEL-142637]
  - net/tcp: Move tcp_inbound_hash() from headers (Davide Caratti) [RHEL-142637]
  - net/tcp: Add a helper tcp_ao_hdr_maclen() (Davide Caratti) [RHEL-142637]
  - net/tcp: Use static_branch_tcp_{md5,ao} to drop ifdefs (Davide Caratti) [RHEL-142637]
  - net/tcp: Only produce AO/MD5 logs if there are any keys (Davide Caratti) [RHEL-142637]
  - tcp: Move TCP-AO bits from cookie_v[46]_check() to tcp_ao_syncookie(). (Davide Caratti) [RHEL-142637]
  - tcp: Cache sock_net(sk) in cookie_v[46]_check(). (Davide Caratti) [RHEL-142637]
  - net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED (Davide Caratti) [RHEL-142637]
  - tcp: Fix Use-After-Free in tcp_ao_connect_init (Davide Caratti) [RHEL-142637] {CVE-2024-27394}
  - net: tcp: remove call to obsolete crypto_ahash_alignmask() (Davide Caratti) [RHEL-142637]
  - net/tcp: Don't store TCP-AO maclen on reqsk (Davide Caratti) [RHEL-142637]
  - net/tcp: Don't add key with non-matching VRF on connected sockets (Davide Caratti) [RHEL-142637]
  - net/tcp: Limit TCP_AO_REPAIR to non-listen sockets (Davide Caratti) [RHEL-142637]
  - net/tcp: Consistently align TCP-AO option in the header (Davide Caratti) [RHEL-142637]
  - tcp: Fix SYN option room calculation for TCP-AO. (Davide Caratti) [RHEL-142637]
  - Documentation/tcp: Fix an obvious typo (Davide Caratti) [RHEL-142637]
  - tcp: Fix -Wc23-extensions in tcp_options_write() (Davide Caratti) [RHEL-142637]
  - net/tcp_sigpool: Fix some off by one bugs (Davide Caratti) [RHEL-142637]
  - net/tcp: fix possible out-of-bounds reads in tcp_hash_fail() (Davide Caratti) [RHEL-142637]
  - Documentation/tcp: Add TCP-AO documentation (Davide Caratti) [RHEL-142637]
  - net/tcp: Add TCP_AO_REPAIR (Davide Caratti) [RHEL-142637]
  - net/tcp: Wire up l3index to TCP-AO (Davide Caratti) [RHEL-142637]
  - net/tcp: Add static_key for TCP-AO (Davide Caratti) [RHEL-142637]
  - net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs) (Davide Caratti) [RHEL-142637]
  - net/tcp: Add TCP-AO getsockopt()s (Davide Caratti) [RHEL-142637]
  - net/tcp: Add option for TCP-AO to (not) hash header (Davide Caratti) [RHEL-142637]
  - net/tcp: Ignore specific ICMPs for TCP-AO connections (Davide Caratti) [RHEL-142637]
  - net/tcp: Add tcp_hash_fail() ratelimited logs (Davide Caratti) [RHEL-142637]
  - net/tcp: Add TCP-AO SNE support (Davide Caratti) [RHEL-142637]
  - net/tcp: Add TCP-AO segments counters (Davide Caratti) [RHEL-142637]
  - net/tcp: Verify inbound TCP-AO signed segments (Davide Caratti) [RHEL-142637]
  - net/tcp: Sign SYN-ACK segments with TCP-AO (Davide Caratti) [RHEL-142637]
  - net/tcp: Wire TCP-AO to request sockets (Davide Caratti) [RHEL-142637]
  - net/tcp: Add TCP-AO sign to twsk (Davide Caratti) [RHEL-142637]
  - net/tcp: Add AO sign to RST packets (Davide Caratti) [RHEL-142637]
  - net/tcp: Add tcp_parse_auth_options() (Davide Caratti) [RHEL-142637]
  - net/tcp: Add TCP-AO sign to outgoing packets (Davide Caratti) [RHEL-142637]
  - net/tcp: Calculate TCP-AO traffic keys (Davide Caratti) [RHEL-142637]
  - net/tcp: Prevent TCP-MD5 with TCP-AO being set (Davide Caratti) [RHEL-142637]
  - net/tcp: Introduce TCP_AO setsockopt()s (Davide Caratti) [RHEL-142637]
  - net/tcp: Add TCP-AO config and structures (Davide Caratti) [RHEL-142637]
  - net/tcp: Prepare tcp_md5sig_pool for TCP-AO (Davide Caratti) [RHEL-142637]
  - tcp: Update stale comment for MD5 in tcp_parse_options(). (Davide Caratti) [RHEL-142637]
  - tcp: Disable header prediction for MD5 flow. (Davide Caratti) [RHEL-142637]
  - tcp: use 2-arg optimal variant of kfree_rcu() (Davide Caratti) [RHEL-142637]
  - net/tcp: Separate initialization of twsk (Davide Caratti) [RHEL-142637]
  - net/tcp: Do cleanup on tcp_md5_key_copy() failure (Davide Caratti) [RHEL-142637]
  - net/tcp: Disable TCP-MD5 static key on tcp_md5sig_info destruction (Davide Caratti) [RHEL-142637]
  - net/tcp: Separate tcp_md5sig_info allocation into tcp_md5sig_info_add() (Davide Caratti) [RHEL-142637]
  - tcp: md5: Allow MD5SIG_FLAG_IFINDEX with ifindex=0 (Davide Caratti) [RHEL-142637]
  - tcp: annotate data-race around tcp_md5sig_pool_populated (Davide Caratti) [RHEL-142637]
  - crypto: cipher - On clone do crypto_mod_get() (Davide Caratti) [RHEL-142637]
  - crypto: api - Add __crypto_alloc_tfmgfp (Davide Caratti) [RHEL-142637]
  - crypto: cmac - Add support for cloning (Davide Caratti) [RHEL-142637]
  - crypto: cipher - Add crypto_clone_cipher (Davide Caratti) [RHEL-142637]
  - crypto: cmac - Use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637]
  - crypto: shash - Allow cloning on algorithms with no init_tfm (Davide Caratti) [RHEL-142637]
  - crypto: cryptd - Add support for cloning hashes (Davide Caratti) [RHEL-142637]
  - crypto: cryptd - Convert hash to use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637]
  - crypto: hmac - Add support for cloning (Davide Caratti) [RHEL-142637]
  - crypto: hash - Add crypto_clone_ahash/shash (Davide Caratti) [RHEL-142637]
  - crypto: api - Add crypto_clone_tfm (Davide Caratti) [RHEL-142637]
  - crypto: api - Add crypto_tfm_get (Davide Caratti) [RHEL-142637]
  - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (Petr Oros) [RHEL-155154]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-739.el9]
changelog:
  - mm/vmscan: fix hard LOCKUP in function isolate_lru_folios (Aristeu Rozanski) [RHEL-153668]
  - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227838] {CVE-2026-64560}
  - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227838] {CVE-2026-64370}
  - posix-timers: Expand timer_[re]arm() callbacks with a boolean return value (Waiman Long) [RHEL-227838]
  - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227838]
  - posix-cpu-timers: Implement the missing timer_wait_running callback (Waiman Long) [RHEL-227838]
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557}
  - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557}
  - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232556]
  - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232556]
  - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232556] {CVE-2026-52991}
  - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232106] {CVE-2026-64191}
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230091] {CVE-2026-64048}
  - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (Eder Zulian) [RHEL-213932] {CVE-2026-68324}
  - iommu/amd: Bound the early ACPI HID map (Eder Zulian) [RHEL-213932] {CVE-2026-68325}
  - iommu/vt-d: Disallow SVA if page walk is not coherent (Eder Zulian) [RHEL-213932]
  - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (Eder Zulian) [RHEL-213932] {CVE-2026-68329}
  - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Eder Zulian) [RHEL-213932] {CVE-2026-43220}
  - iommu/amd: move wait_on_sem() out of spinlock (Eder Zulian) [RHEL-213932] {CVE-2026-43253}
  - iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (Eder Zulian) [RHEL-213932]
  - iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds (Eder Zulian) [RHEL-213932]
  - iommufd/viommu: Release the igroup lock on the vdevice_size error path (Eder Zulian) [RHEL-213932]
  - iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Eder Zulian) [RHEL-213932]
  - iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path (Eder Zulian) [RHEL-213932]
  - iommu/iommufd: Fix IOPF group ownership UAF (Eder Zulian) [RHEL-213932]
  - iommu: Avoid copying the user array twice in the full-array copy helper (Eder Zulian) [RHEL-213932]
  - iommufd: Set upper bounds on cache invalidation entry_num and entry_len (Eder Zulian) [RHEL-213932] {CVE-2026-64289}
  - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb (Eder Zulian) [RHEL-213932] {CVE-2026-53164}
  - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932]
  - iommufd: Break the loop on failure in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] {CVE-2026-64290}
  - iommufd: Reject invalid read count in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932]
  - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() (Eder Zulian) [RHEL-213932]
  - iommufd: Reject invalid read count in iommufd_veventq_fops_read() (Eder Zulian) [RHEL-213932]
  - iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails (Eder Zulian) [RHEL-213932]
  - iommu/vt-d: Fix RB-tree corruption in probe error path (Eder Zulian) [RHEL-213932]
  - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-213932]
  - iommu/vt-d: Avoid WARNING in sva unbind path (Eder Zulian) [RHEL-213932] {CVE-2026-64591}
  - dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device (Eder Zulian) [RHEL-213932]
  - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments (Eder Zulian) [RHEL-213932]
  - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() (Eder Zulian) [RHEL-213932]
  - iommufd: Set veventq_depth upper bound (Eder Zulian) [RHEL-213932] {CVE-2026-64291}
  - iommufd: Fix data_len byte-count vs element-count mismatch (Eder Zulian) [RHEL-213932]
  - drm/tegra: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932]
  - gpu: host1x: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932]
  - iommu/amd: Fix premature break in init_iommu_one() (Eder Zulian) [RHEL-213932]
  - iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match table (Eder Zulian) [RHEL-213932]
  - iommu/vt-d: Disable DMAR for Intel Q35 IGFX (Eder Zulian) [RHEL-213932]
  - iommu/amd: Bounds-check devid in __rlookup_amd_iommu() (Eder Zulian) [RHEL-213932] {CVE-2026-53283}
  - iommu/amd: Fix a stale comment about which legacy mode is user visible (Eder Zulian) [RHEL-213932]
  - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read (Eder Zulian) [RHEL-213932] {CVE-2026-64293}
  - iommufd: Fix a race with concurrent allocation and unmap (Eder Zulian) [RHEL-213932]
  - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-213932] {CVE-2026-53053}
  - iommu/vt-d: Block PASID attachment to nested domain with dirty tracking (Eder Zulian) [RHEL-213932] {CVE-2026-53372}
  - iommufd: Fix return value of iommufd_fault_fops_write() (Eder Zulian) [RHEL-213932]
  - dma-mapping: add missing `inline` for `dma_free_attrs` (Eder Zulian) [RHEL-213932]
  - iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement (Eder Zulian) [RHEL-213932]
  - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() (Eder Zulian) [RHEL-213932]
  - iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update (Eder Zulian) [RHEL-213932]
  - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() (Eder Zulian) [RHEL-213932]
  - iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} (Eder Zulian) [RHEL-213932]
  - iommufd: vfio compatibility extension check for noiommu mode (Eder Zulian) [RHEL-213932]
  - iommu/arm-smmu-qcom: do not register driver in probe() (Eder Zulian) [RHEL-213932]
  - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Eder Zulian) [RHEL-213932] {CVE-2025-71122}
  - iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Eder Zulian) [RHEL-213932]
  - dmaengine: tegra: Fix burst size calculation (Eder Zulian) [RHEL-213921]
  - dmaengine: Fix possible use after free (Eder Zulian) [RHEL-213921]
  - dmaengine: qcom: gpi: set DMA_PRIVATE capability (Eder Zulian) [RHEL-213921]
  - dmaengine: imx-sdma: Refine spba bus searching in probe (Eder Zulian) [RHEL-213921]
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178418] {CVE-2026-43501}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-740.el9]
changelog:
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226701] {CVE-2026-43493}
  - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228526] {CVE-2026-63952}
  - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228526]
  - perf/x86/intel/uncore: Fix uncore_die_to_cpu() for offline dies (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Implement global init callback for GNR uncore (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Move die_to_cpu() to uncore.c (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Guard against invalid box control address (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems (Michael Petlan) [RHEL-115125]
  - perf/x86/intel: Fix OMR snoop information parsing issues (Michael Petlan) [RHEL-115121]
  - perf/x86/intel/uncore: Remove extra double quote mark (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Fix die ID init and look up bugs (Michael Petlan) [RHEL-115125] {CVE-2026-43344}
  - perf/x86/intel/uncore: Skip discovery table for offline dies (Michael Petlan) [RHEL-115125] {CVE-2026-43079}
  - perf/x86/intel/uncore: Fix iounmap() leak on global_init failure (Michael Petlan) [RHEL-115125]
  - perf/x86/intel: Enable auto counter reload for DMR (Michael Petlan) [RHEL-117336]
  - perf/x86/intel: Add support for rdpmc user disable feature (Michael Petlan) [RHEL-117336]
  - perf/x86: Print PMU counters bitmap in x86_pmu_show_pmu_cap() (Michael Petlan) [RHEL-117336]
  - perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Michael Petlan) [RHEL-117336]
  - KVM: x86/pmu: Manipulate FIXED_CTR_CTRL MSR with macros (Michael Petlan) [RHEL-117336]
  - KVM: x86/pmu: Change ambiguous _mask suffix to _rsvd in kvm_pmu (Michael Petlan) [RHEL-117336]
  - perf/x86/intel: Change macro GLOBAL_CTRL_EN_PERF_METRICS to BIT_ULL(48) (Michael Petlan) [RHEL-117336]
  - perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag (Michael Petlan) [RHEL-117336]
  - perf/x86: Use macros to replace magic numbers in attr_rdpmc (Michael Petlan) [RHEL-117336]
  - perf/x86/intel: Add core PMU support for Novalake (Michael Petlan) [RHEL-117336]
  - perf/x86/intel: Add support for PEBS memory auxiliary info field in NVL (Michael Petlan) [RHEL-117336]
  - perf/x86/intel: Add core PMU support for DMR (Michael Petlan) [RHEL-115121]
  - perf/x86/intel: Add support for PEBS memory auxiliary info field in DMR (Michael Petlan) [RHEL-115121]
  - perf/uapi: Clean up <uapi/linux/perf_event.h> a bit (Michael Petlan) [RHEL-115121]
  - tools headers: Update the uapi/linux/perf_event.h copy with the kernel sources (Michael Petlan) [RHEL-115121]
  - perf: Extend per event callchain limit to branch stack (Michael Petlan) [RHEL-115121]
  - perf/x86/intel: Support the 4 new OMR MSRs introduced in DMR and NVL (Michael Petlan) [RHEL-115121]
  - perf/x86/intel: Add a check for dynamic constraints (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Disable PMI for self-reloaded ACR events (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Optimize PEBS extended config (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Always reprogram ACR events to prevent stale masks (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Improve validation and configuration of ACR masks (Anubhav Shelat) [RHEL-45125] {CVE-2026-53370}
  - perf/x86: Fix potential bad container_of in intel_pmu_hw_config (Anubhav Shelat) [RHEL-45125] {CVE-2026-31782}
  - perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error (Anubhav Shelat) [RHEL-45125] {CVE-2025-40122}
  - perf/x86/intel: Fix incorrect MSR index calculations in intel_pmu_config_acr() (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Use early_initcall() to hook bts_init() (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Fix and clean up intel_pmu_drain_arch_pebs() type use (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Add counter group support for arch-PEBS (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Setup PEBS data configuration and enable legacy groups (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Update dyn_constraint base on PEBS event precise level (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Allocate arch-PEBS buffer and initialize PEBS_BASE MSR (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Process arch-PEBS records or record fragments (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel/ds: Factor out PEBS group processing code to functions (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Allow to update user space GPRs from PEBS records (Anubhav Shelat) [RHEL-45125]
  - perf/core: Check sample_type in perf_sample_save_callchain (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel/ds: Remove redundant assignments to sample.period (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel/ds: Factor out PEBS record processing code to functions (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Initialize architectural PEBS (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Introduce pairs of PEBS static calls (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Parse CPUID archPerfmonExt leaves for non-hybrid CPUs (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Rename x86_pmu.pebs to x86_pmu.ds_pebs (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Decouple BTS initialization from PEBS initialization (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Correct large PEBS flag check (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Replace x86_pmu.drain_pebs calling with static call (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Support auto counter reload (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Use better start period for frequency mode (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Add CPUID enumeration for the auto counter reload (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel: Track the num of events needs late setup (Anubhav Shelat) [RHEL-45125]
  - perf/x86: Add dynamic constraint (Anubhav Shelat) [RHEL-45125]
  - perf/x86/intel/uncore: Convert comma to semicolon (Michael Petlan) [RHEL-117338]
  - perf/x86/intel/uncore: Add Nova Lake support (Michael Petlan) [RHEL-117338]
  - perf/x86/intel/uncore: Add missing PMON units for Panther Lake (Michael Petlan) [RHEL-115125]
  - perf pmu: Relax uncore wildcard matching to allow numeric suffix (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Update DMR uncore constraints preliminarily (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Support uncore constraint ranges (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Support IIO free-running counters on DMR (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Add freerunning event descriptor helper macro (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Add domain global init callback (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Add CBB PMON support for Diamond Rapids (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Add IMH PMON support for Diamond Rapids (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Remove has_generic_discovery_table() (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Support per-platform discovery base devices (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/uncore: Move uncore discovery init struct to header (Michael Petlan) [RHEL-115125]
  - perf/x86/intel/cstate: Add Diamond Rapids support (Michael Petlan) [RHEL-115123]
  - perf/x86/intel/cstate: Add Nova Lake support (Michael Petlan) [RHEL-120358]
  - perf/x86/intel/cstate: Add Wildcat Lake support (Michael Petlan) [RHEL-95669]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-741.el9]
changelog:
  - dm cache policy smq: check allocation under invalidate lock (Benjamin Marzinski) [RHEL-231826] {CVE-2026-53062}
  - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190190]
  - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190190] {CVE-2026-53246}
  - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234286] {CVE-2026-64564}
  - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231453] {CVE-2026-64277}
  - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230265] {CVE-2026-64276}
  - sctp: prevent peer transport count overflow (CKI Backport Bot) [RHEL-214461]
  - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212388]
  - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188202] {CVE-2026-52924}
  - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182345] {CVE-2026-53266}
  - ipv6: add NULL checks for idev in SRv6 paths (CKI Backport Bot) [RHEL-152701]


author: Tao Liu <ltao@redhat.com> - 2.0.29-6
changelog:
  - 99-kdump.conf: Omit rdma module
  - Fallback to get NIC driver by /sys/class/net/NIC/device/driver/module
  - Note user-specified crashkernel value will be overwritten by default value


author: Tao Liu <ltao@redhat.com> - 2.0.29-7
changelog:
  - 99-kdump.conf: Omit clevis related dracut modules
  - kdump-lib.sh: rounded up the total_mem to 128M in get_system_size
  - kdump-lib.sh: Adjust default crashkernel reservation for x86_64 and s390x
  - doc/kdump.conf: correctly align the options


author: Tao Liu <ltao@redhat.com> - 2.0.29-8
changelog:
  - kdumpctl: check and generate /etc/vconsole.conf
  - kdump-lib.sh: Reserve crashkernel by default for systems with 1G-2G memory


author: Tao Liu <ltao@redhat.com> - 2.0.29-12
changelog:
  - Allow "sudo kdumpctl" for LUKS dump target
  - Restore SELinux label of crypttab file
  - Allow kdump.service to access LUKS volume keys
  - Wait for LUKS configfs API to be ready
  - Change LUKS volume key prefix to kdump-cryptsetup:vk-
  - Remove unused LUKS volume keys from keyring
  - Limit LUKS support to x86_64
  - Add kdumpctl setup-crypttab subcommand
  - Return LUKS devices in the form of UUIDs directly
  - Fix SC2181 issues in kdump-udev-throttler
  - LUKS: make /usr writable
  - Address CPU/memory hot plugging for kdump LUKS support
  - shfmt kdump-udev-throttler
  - Use cryptsetup --link-vk-to-keyring to save volume keys
  - Support dumping to a LUKS-encrypted target
  - Add a helper function to get uuid by MAJ:MIN


author: Pingfan Liu <piliu@redhat.com> - 2.0.29-14
changelog:
  - powerpc: Set nr_cpus=16 for kdump kernel
  - powerpc: consider CPU count while calculating crashkernel value
  - Use all available CPUs to collect dump


author: Lichen Liu <lichliu@redhat.com> - 2.0.29-15
changelog:
  - sysconfig: use initramfs_options to reduce memory usage
  - kdump-lib-initramfs: rewrite kdump_get_conf_val
  - kdump-lib-initramfs: Fix performance regression in kdump_get_conf_val


author: Julien Rische <jrische@redhat.com> - 1.21.1-3
changelog:
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45402 RHEL-45392


author: Julien Rische <jrische@redhat.com> - 1.21.1-4
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-55423
  - Fix various issues detected by static analysis
    Resolves: RHEL-58216
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-15323


author: Julien Rische <jrische@redhat.com> - 1.21.1-5
changelog:
  - Support PKCS11 EC client certs in PKINIT
    Resolves: RHEL-74374
  - kdb5_util: fix DB entry flags on modification
    Resolves: RHEL-56059
  - Add ECDH support for PKINIT (RFC5349)
    Resolves: RHEL-4902


author: Julien Rische <jrische@redhat.com> - 1.21.1-8
changelog:
  - Do not block HMAC-MD4/5 in FIPS mode
    Resolves: RHEL-88704
  - Don't issue RC4 session keys by default (CVE-2025-3576)
    Resolves: RHEL-88048
  - Add PKINIT paChecksum2 from MS-PKCA v20230920
    Resolves: RHEL-82647


author: Julien Rische <jrische@redhat.com> - 1.21.1-9
changelog:
  - krad: packet ID fetched from uninitialized variable
    Resolves: RHEL-145355
  - Create sub-package for xrealmauthz KDC plugin
    Resolves: RHEL-67468
  - Improving kerberos ulog resize efficiency
    Resolves: RHEL-145359


author: Julien Rische <jrische@redhat.com> - 1.21.1-10
changelog:
  - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    Resolves: RHEL-171591 RHEL-171593


author: Julien Rische <jrische@redhat.com> - 1.20.1-4
changelog:
  - Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
  - Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf
    Resolves: rhbz#2068535


author: Julien Rische <jrische@redhat.com> - 1.20.1-5
changelog:
  - Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
  - Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode
    Resolves: rhbz#2162461


author: Julien Rische <jrische@redhat.com> - 1.20.1-9
changelog:
  - Do not disable PKINIT if some of the well-known DH groups are unavailable
    Resolves: rhbz#2187722
  - Make PKINIT CMS SHA-1 signature verification available in FIPS mode
    Resolves: rhbz#2155607
  - Allow to set PAC ticket signature as optional
    Resolves: rhbz#2178298


author: Julien Rische <jrische@redhat.com> - 1.21.1-1
changelog:
  - New upstream version (1.21.1)
  - Fix double-free in KDC TGS processing (CVE-2023-39975)
  - Add support for "pac_privsvr_enctype" KDB string attribute
    Resolves: rhbz#2060421


author: Julien Rische <jrische@redhat.com> - 1.21.1-2
changelog:
  - Fix memory leak in GSSAPI interface
    Resolves: RHEL-27251
  - Fix memory leak in PMAP RPC interface
    Resolves: RHEL-27245
  - Fix memory leak in failing UTF-8 to UTF-16 re-encoding for PAC
    Resolves: RHEL-27253
  - Make TCP waiting time configurable
    Resolves: RHEL-17132


author: Steve Dickson <steved@redhat.com> 0.10-0
changelog:
  - Initial package
  - Upstream contributions by:
      - Chuck Lever <chuck.lever@oracle.com>
      - Hannes Reinecke <hare@suse.de>
      - Jeff Layton <jlayton@kernel.org>
      - Benjamin Coddington <bcodding@redhat.com>
      - David Härdeman <david@hardeman.nu>
      - Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
      - Moritz "WanzenBug" Wanzenböck <moritz.wanzenboeck@linbit.com>


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.4-1
changelog:
  - Update to version 4.23.4
  - resolves: RHEL-114548 - Update to version 4.23.4
  - resolves: RHEL-132995 - Fix Time Machine backup
  - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-1
changelog:
  - Update to version 4.23.5
  - resolves: RHEL-143401 - Fix winbind group resolution
  - resolves: RHEL-141027 - Fix winbind crash


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.24.3-1
changelog:
  - Update to version 4.24.3
  - resolves: RHEL-156320 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba:
    various flaws
  - resolves: RHEL-161658 - CVE-2026-4480 Samba: Remote Code Execution in
    printing
  - resolves: RHEL-170594 - CVE-2026-40170 samba: ngtcp2
  - resolves: RHEL-177925 - CVE-2026-4408 samba: Remote Code Execution in
    SAMR
  - resolves: RHEL-166869 - build hardening with FORTIFY_SOURCE


author: Honza Horak <hhorak@redhat.com> - 590-1
changelog:
  - Update to the version 590
  - Also solves the "message overlay" in the terminal
    Resolves: #2062188


author: Marek Polacek <polacek@redhat.com> 11.5.0-2
changelog:
  - fix TARGET_CPU_DEFAULT (PR target/105157, RHEL-50037)
  - libstdc++: Workaround kernel-headers on s390x-linux (RHEL-50054)
  - fix wrong code with memcpy from _Complex (PR tree-optimization/116034)


author: Florian Weimer <fweimer@redhat.com> - 11.5.0-10
changelog:
  - Exception handling performance improvements (RHEL-105072)
  - libgcc: Use _dl_find_object to find DWARF data in unwinder
  - libgcc: Use lock-free data structures for run-time unwinder registration


author: David Malcolm <dmalcolm@redhat.com> - 11.5.0-14
changelog:
  - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding
    branches and calls to gcov output, but not conditions (RHEL-105416).


author: Marek Polacek <polacek@redhat.com> 11.4.1-3
changelog:
  - update from releases/gcc-11-branch (RHEL-17638)
    - PRs c++/106310, c++/106890, c++/109666, c++/109761, c++/111357,
  	c++/111512, c++/112795, d/108842, d/110359, d/110511, d/110516,
  	debug/110295, fortran/95947, fortran/103506, fortran/107397,
  	fortran/110288, fortran/110585, fortran/110658, fortran/111837,
  	fortran/111880, libstdc++/95048, libstdc++/99327, libstdc++/104161,
  	libstdc++/104242, libstdc++/108178, libstdc++/111050,
  	libstdc++/111511, libstdc++/112314, libstdc++/112491,
  	middle-end/110200, middle-end/111699, middle-end/111818,
  	middle-end/112733, rtl-optimization/110237, sanitizer/112727,
  	target/96762, target/101177, target/101469, target/105325,
  	target/109800, target/109932, target/110011, target/110044,
  	target/110170, target/110309, target/110741, target/111001,
  	target/111340, target/111367, target/111408, target/111815,
  	target/112672, target/112816, target/112837, target/112845,
  	target/112891, testsuite/66005, tree-optimization/110298,
  	tree-optimization/110731, tree-optimization/110914,
  	tree-optimization/111015, tree-optimization/111614,
  	tree-optimization/111764, tree-optimization/111917
  - use -fno-stack-protector in some aarch64 tests


author: Marek Polacek <polacek@redhat.com> 11.5.0-1
changelog:
  - update from releases/gcc-11 branch (RHEL-35635)
    - GCC 11.5 release
    - PRs ada/113893, ada/113979, analyzer/104042, c/113262, c/114007, c/114493,
  	c++/89224, c++/92145, c++/92407, c++/97990, c++/99710, c++/100667,
  	c++/100772, c++/101765, c++/103185, c++/104051, c++/111485,
  	c++/111529, c++/113598, c++/113674, c++/114537, c++/114561,
  	c++/114562, c++/114572, c++/114634, c++/114691, d/113125, d/113758,
  	d/114171, debug/111080, debug/112718, driver/115440, fortran/50410,
  	fortran/103715, fortran/104908, fortran/107426, fortran/114474,
  	fortran/114825, gcov-profile/114115, libfortran/110651,
  	libgomp/113192, libquadmath/114533, libstdc++/104259,
  	libstdc++/104606, libstdc++/105417, libstdc++/110054,
  	libstdc++/113250, libstdc++/114147, libstdc++/114401,
  	libstdc++/114750, libstdc++/114803, libstdc++/115269,
  	libstdc++/115454, libstdc++/115575, middle-end/90348,
  	middle-end/95351, middle-end/107385, middle-end/108789,
  	middle-end/110027, middle-end/110115, middle-end/110176,
  	middle-end/111422, middle-end/111632, middle-end/112732,
  	middle-end/113907, middle-end/113921, middle-end/114599,
  	middle-end/114734, middle-end/114753, middle-end/115527,
  	middle-end/115836, objc/101666, objc/101718, preprocessor/105608,
  	rtl-optimization/100303, rtl-optimization/108086,
  	rtl-optimization/110079, rtl-optimization/114768,
  	rtl-optimization/114902, rtl-optimization/115092, sanitizer/97696,
  	sanitizer/111736, sanitizer/114956, sanitizer/115172, target/88309,
  	target/101737, target/101865, target/105522, target/108120,
  	target/108743, target/110411, target/111610, target/111677,
  	target/112397, target/113122, target/113281, target/114049,
  	target/114098, target/114130, target/114184, target/114310,
  	target/114837, target/114846, target/115253, target/115297,
  	target/115360, target/115457, target/115475, target/115611,
  	target/115691, testsuite/113175, testsuite/114034, testsuite/114036,
  	tree-optimization/110386, tree-optimization/110422,
  	tree-optimization/111039, tree-optimization/111070,
  	tree-optimization/111331, tree-optimization/111407,
  	tree-optimization/111445, tree-optimization/111736,
  	tree-optimization/112495, tree-optimization/112505,
  	tree-optimization/112793, tree-optimization/113372,
  	tree-optimization/113552, tree-optimization/113603,
  	tree-optimization/114027, tree-optimization/114115,
  	tree-optimization/114566, tree-optimization/114876,
  	tree-optimization/115192, tree-optimization/115337,
  	tree-optimization/115843
  - fix FLUSH IOSTAT value (PR libfortran/101255, RHEL-32536)
  - fix conditions for using memcmp in
    std::lexicographical_compare_three_way (PR libstdc++/113960)


author: Alexey Tikhonov <atikhono@redhat.com> - 0.6.1-51
changelog:
  - Resolves: rhbz#1938708 - review of important potential issues detected by static analyzers in ding-libs-0.6.1-47.el9


author: Karel Zak <kzak@redhat.com> 2.37.4-12
changelog:
  - fix #2133396 - Internal testsuite for cramfs fails on s390x
  - fix #2174748 - enable uuidd cont-clock by default
  - fix #2182169 - lscpu: backport ARM human-readable names from upstream
  - fix #2189947 - libuuid - downport cache related patch
  - fix #2203324 - zram module does not have algorithms mentioned in zramctl command
  - fix #2209267 - Add additional documentation on devices being auto-mounted if a device exists within fstab.
  - fix #2215082 - For the 'sfdisk' man page to further clarify the expected behavior and intended use of the -d option


author: Karel Zak <kzak@redhat.com> 2.37.4-16
changelog:
  - fix RHEL-16048 - uninitialized memory in SCM_CREDENTIALS in logger(1)
  - fix RHEL-21257 - logger sending process start time not current time with log messages
  - fix RHEL-16071 - issues in libblkid
  - fix RHEL-12783 - lscpu -e doesn't show the current real frequency value
  - fix RHEL-14612 - Userspace mount options are not preserved for NFS


author: Karel Zak <kzak@redhat.com> 2.37.4-19
changelog:
  - fix RHEL-34165 - lsipc: fix semaphore USED counter
  - fix RHEL-25265 - libblkid: Check offset in LUKS2 header
  - fix RHEL-25559 - more: fix poll() use


author: Karel Zak <kzak@redhat.com> 2.37.4-21
changelog:
  - fix RHEL-56354 - lib/timeutils: parse_timestamp: fix second parsing
  - fix RHEL-56983 - sulogin: fix POSIX locale use


author: Karel Zak <kzak@redhat.com> 2.37.4-22
changelog:
  - fix RHEL-113638 - lscpu: update ARM identifiers
  - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification


author: Karel Zak <kzak@redhat.com> 2.37.4-23
changelog:
  - fix RHEL-123527 - mount: improve --all documentation
  - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation


author: Miro Hrončok <mhroncok@redhat.com> - 1.0.9-10
changelog:
  - Accept output_buffer_limit as an alias for max_output_length
    in Decompressor.process() for forward compatibility with upstream 1.2.0
  - Resolves: RHEL-221150


author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 2.48-9
changelog:
  - Fix integer overflow in _libcap_strdup() (CVE-2023-2603)
    Resolves: rhbz#2210638
  - Correctly check pthread_create() return value to avoid memory leak (CVE-2023-2602)
    Resolves: rhbz#2222198


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Fix a crash when clearing COMPS_ObjRTree (RhBug:1888343)
  - Fix memory leaks and resource leaks


author: Filip Januš <fjanus@redhat.com> - 5.3.28-54
changelog:
  - Add db_converter into -utils subpackage
  - It allowes to convert BerkeleyDB database format to GDBM/LMDB format
  - Resolves: RHEL-35607


author: Jaroslav Rohel <jrohel@redhat.com> - 0.69.0-7
changelog:
  - filterAdvisory: match installed_solvables sort with lower_bound (RhBug:2212838, RHEL-12123)
  - hawkey.subject: get_best_selectors only obsoleters of latest (RhBug:2183279, RHEL-6304)
  - Avoid reinstalling installonly packages marked for ERASE (RhBug:2163474, RHEL-12124)


author: Petr Pisar <ppisar@redhat.com> - 0.69.0-9
changelog:
  - Grow memory if applying a query after increasing a number of available
    packages (RHEL-27657)
  - Fix a memory leak in get_best_solution() (RHEL-26226)
  - Fix destructing libdnf::TransactionItem from a base class (RHEL-26240)


author: Petr Pisar <ppisar@redhat.com> - 0.69.0-11
changelog:
  - Fix reinstalling packages which conflicts with themselves in
    dnf_transaction_commit() (RHEL-1454)


author: Evan Goode <egoode@redhat.com> - 0.69.0-16
changelog:
  - Introduce $releasever_major, $releasever_minor variables, shell-style
    variable substitution (RHEL-95006)


author: Ales Matej <amatej@redhat.com> - 0.69.0-18
changelog:
  - Fix a crash when parsing multiple key files fails (RHEL-145618)
  - Mark all protected packages as user installed for all transactions (RHEL-76112)
  - Add `filterUnneededExtraUserinstalled` and Python version to the API
  - Describe all problems even when there are protected removals (RHEL-115194)
  - Clearer error for protected package broken dependencies


author: Pino Toscano <ptoscano@redhat.com> 1.29.41-1
changelog:
  - feat: update man page with deprecation notices (jajerome@redhat.com)
  - feat: Disable anonymous cloud registration temporarily (mhorky@redhat.com)
  - feat: Deprecate 'syspurpose addons' (mhorky@redhat.com)
  - fix: make SyspurposeComplianceStatusCache.get_overall_status() always usable
    (ptoscano@redhat.com)
  - fix: Change order of checks (jhnidek@redhat.com)
  - fix: Cache shouldn't try to get data from server without UUID
    (jhnidek@redhat.com)
  - feat: Deprecate import command (zpetrace@redhat.com)
  - fix: 1.29 modify section about remove command in man page
    (jhnidek@redhat.com)
  - feat: 1.29 Deprecate redeem sub-command (jhnidek@redhat.com)
  - fix: Reformated man page of subscription-manager (jhnidek@redhat.com)
  - fix: [1.29] Remove command should not be primary command (jhnidek@redhat.com)
  - feat: deprecate autosubscribe/auto-attach register options
    (jajerome@redhat.com)
  - feat: deprecate attach/auto-attach modules (jajerome@redhat.com)
  - docs: deprecate attach/auto-attach in man page (jajerome@redhat.com)
  - fix: Hide subscription management "errors" in container mode
    (mhorky@redhat.com)
  - feat: 1.29 Deprecate remove sub-command (jhnidek@redhat.com)
  - fix: 1.29 Do not try to test this branch for Fedora latest
    (jhnidek@redhat.com)
  - fix: 1.29 Do not try to test this branch for Fedora rawhide
    (jhnidek@redhat.com)
  - fix(test): Properly stop method mock (mhorky@redhat.com)
  - feat: Azure: added extended location and type of location fact
    (jhnidek@redhat.com)
  - fix: Update version of Azure metadata (jhnidek@redhat.com)
  - feat: Added Azure location to facts (jhnidek@redhat.com)
  - feat: Added zone GCP fact (jhnidek@redhat.com)
  - feat: Added more AWS cloud facts (jhnidek@redhat.com)
  - fix: Change type hint according returned value. (jhnidek@redhat.com)
  - feat: Add warning message about release version to dnf plugin
    (jhnidek@redhat.com)
  - Bump black from 23.3.0 to 24.3.0
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Format code with black==24.3.0 (ptoscano@redhat.com)
  - Fix memory leaks in test-productdb.c (jhnidek@redhat.com)
  - Fix memory leaks in productdb.c (jhnidek@redhat.com)
  - fix: Function prototype without declaration is deprecated
    (jhnidek@redhat.com)
  - Removed unused includes of .h files (jhnidek@redhat.com)
  - libdnf: switch from g_error_free() to g_clear_error() in tests
    (ptoscano@redhat.com)
  - libdnf: do not build test code in plugin (ptoscano@redhat.com)
  - Change handling of deprecated `datetime.datetime.utcnow()`
    (mhorky@redhat.com)
  - CCT-66: Update identity reporting in DNF plugin during autoregistration
    (mhorky@redhat.com)
  - Remove automatic registration delay for rhsmcertd (mhorky@redhat.com)
  - Remove API endpoint for automatic cloud registration v1 (mhorky@redhat.com)
  - CCT-67: Use automatic registration v2 (mhorky@redhat.com)
  - IdentityUpdateAction: Improve logging for updating identity certificates
    (mhorky@redhat.com)
  - Identity: Add method to extract current owner (mhorky@redhat.com)
  - rhsmcertd: Define exit codes (mhorky@redhat.com)
  - rhsmcertd: Use module-level logger (mhorky@redhat.com)
  - Add AnonymousCertificateManager (mhorky@redhat.com)
  - Add CloudTokenCache for Candlepin JWT (mhorky@redhat.com)
  - Implement API endpoints for Automatic registration v2 (mhorky@redhat.com)
  - Update documentation for one API call in connection.py (mhorky@redhat.com)
  - Fix type hint of RegisterService.register() (mhorky@redhat.com)
  - rhsmcertd: Drop D-Bus loop code (mhorky@redhat.com)
  - rhsmcertd: Add type hints (mhorky@redhat.com)
  - rhsmcertd: Remove forgotten old comment (mhorky@redhat.com)
  - Stop logging full lscpu output (mhorky@redhat.com)
  - Prevent double-logging of syspurpose cache log statement (mhorky@redhat.com)
  - Update the log message containing response time statistics
    (mhorky@redhat.com)
  - CCT-266: Update TLS flags (mhorky@redhat.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.29.43-1
changelog:
  - [1.29] feat/cct-868: Subset of list command options marked as deprecated *
    Options --available, --all, --ondate, --servicelevel --no-overlap --match-
    install, --pool-only, --afterdate were marked as deprecated in ListCommand
    definition of their help string. (mgrunwal@redhat.com)
  - fix: Handle Retry-After headers better for 429 responses (mhorky@redhat.com)
  - feat: Better automatic registration logging (mhorky@redhat.com)
  - fix: perform autoreg waiting when performing standard autoreg
    (ptoscano@redhat.com)
  - chore: move autoreg waiting code in own function (ptoscano@redhat.com)
  - docs: update proxy details in man page (jvlcek@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.44-1
changelog:
  - Revert "feat: Disable anonymous cloud registration temporarily"
    (ptoscano@redhat.com)
  - Revert "feat: forcefully switch automatic cloud registration to v1"
    (ptoscano@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ptoscano@redhat.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (French) (leane.grasser@proton.me)
  - Update translation files (noreply@weblate.org)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - Translated using Weblate (Italian) (info@salvatorecocuzza.it)
  - Translated using Weblate (French) (leane.grasser@proton.me)
  - Translated using Weblate (German) (atalanttore@googlemail.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)


author: Pino Toscano <ptoscano@redhat.com> 1.29.45-1
changelog:
  - fix: Do not upload profile from DNF, when it is disabled in conf
    (jhnidek@redhat.com)
  - feat: dnf plugin - outsource uploading of profile to rhsmcertd.
    (jhnidek@redhat.com)
  - feat: Enable register with environment names and environment types
    (jhnidek@redhat.com)
  - feat: support registering specifying environments with activation keys
    (ryanverdile@gmail.com)
  - chore: Remove auto-assign CI job (mhorky@redhat.com)
  - feat: [1.29] Added basic configuration for Packit (jhnidek@redhat.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.29.46-1
changelog:
  - Translated using Weblate (Italian) (info@salvatorecocuzza.it)
  - Translated using Weblate (Italian) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Translated using Weblate (Italian) (info@salvatorecocuzza.it)
  - Translated using Weblate (Spanish) (fserrador@gmail.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Chinese (Traditional) (zh_TW)) (chzang55@gmail.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (mhorky@redhat.com)
  - Translated using Weblate (Georgian) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Translated using Weblate (French) (leane.grasser@proton.me)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Korean) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Korean) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Update translation files (noreply@weblate.org)
  - fix: Handle improperly closed connections (mhorky@redhat.com)
  - ci: use the right distro for coverage reporting (ptoscano@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (French) (leane.grasser@proton.me)
  - tests: fix mocking of get_terminal_width() in TestColumnize
    (ptoscano@redhat.com)
  - feat: print compliance errors & syspurpose status only in entitlement mode
    (ptoscano@redhat.com)
  - feat: print "registered" as status when using SCA (ptoscano@redhat.com)
  - feat: print "not registered" on status when not registered
    (ptoscano@redhat.com)
  - tests: force syspurpose tests in test_status to non-SCA (ptoscano@redhat.com)
  - refactor: move determination of content access mode in own method
    (ptoscano@redhat.com)
  - tests: move StubIdentity to stubs (ptoscano@redhat.com)
  - tests: cleanup dead/broken bits in test_status (ptoscano@redhat.com)
  - chore: move banner printing to its own function (ptoscano@redhat.com)
  - fix: Append two additional facts to the graylist (pkoprda@redhat.com)
  - refactor: Use class constant instead of variable graylist
    (pkoprda@redhat.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.29.47-1
changelog:
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Spanish) (fserrador@gmail.com)
  - Translated using Weblate (Spanish) (jsefler@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - fix: [1.29] Wait random time before reaching IMDS server (jhnidek@redhat.com)
  - feat: [1.29] Call random.seed() at begining of auto-register
    (jhnidek@redhat.com)
  - feat: [1.29] Better control over auto-reg waiting game (jhnidek@redhat.com)
  - fix: [1.29] Enable content during auto-registration v2 (jhnidek@redhat.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.29.48-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - ci: bump actions/upload-artifact from 4 to 5
    (49699333+dependabot[bot]@users.noreply.github.com)
  - feat: [1.29] Added dnf4 warning about skewed clock (jhnidek@redhat.com)
  - fix: [1.29] Require findutils in .spec file (jhnidek@redhat.com)
  - ci: bump actions/checkout from 4 to 5
    (49699333+dependabot[bot]@users.noreply.github.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.29.49-1
changelog:
  - RHEL-126157: Update GCP to Google Cloud in log messages (crag@redhat.com)
  - fix: Update user-facing GCP refrences to Google Cloud (crag@redhat.com)
  - feat: check if --set arg is empty when the environments module is called
    (manuelcanorojo@gmail.com)
  - feat: Added more debug prints to cloud-what (jhnidek@redhat.com)
  - fix(test): Fix unit test of aws (jhnidek@redhat.com)
  - fix: Fix getting AWS IMDSv2 signature (jhnidek@redhat.com)
  - chore: Make new black happy again (jhnidek@redhat.com)
  - chore: Increased log level of messages (jhnidek@redhat.com)
  - fix: Use IMDSv2 for signature first (jhnidek@redhat.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Georgian) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Added translation using Weblate (Finnish) (noreply-addon-
    languages@weblate.org)
  - fix: TypeError in _get_tls_handshake_info type hinting (macano@redhat.com)
  - feat: added signature type log in TLS handshake (macano@redhat.com)
  - feat: added internal method to get tls handshake info
    (manuelcanorojo@gmail.com)
  - ci: bump actions/upload-artifact from 5 to 6
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Fix profile upload because of missing self.cp (suttner@atix.de)
  - Fix upload profile if rhsmcertd is not running at all (suttner@atix.de)
  - ci: bump actions/checkout from 5 to 6
    (49699333+dependabot[bot]@users.noreply.github.com)


author: Jason Jerome <jajerome@redhat.com> 1.29.51-1
changelog:
  - integration-tests: Run the subman-cockpit tests with 2 GB RAM
    (marius.vollmer@gmail.com)
  - fix(backport): skip package profile upload when disabled in config
    (jajerome@redhat.com)
  - fix: allow system to be registered with broken insights-client
    (jlocash@redhat.com)
  - ci: bump actions/upload-artifact from 6 to 7
    (49699333+dependabot[bot]@users.noreply.github.com)
  - fix: Handle non-existence of /var/cache/cloud-what gracefully
    (jhnidek@redhat.com)
  - fix(unit-tests): Fixed unit tests for rhsm-debug (jhnidek@redhat.com)
  - feat: Add /var/cache/cloud-what/ to sos-report (jhnidek@redhat.com)


author: Jason Jerome <jajerome@redhat.com> 1.29.52-1
changelog:
  - Translated using Weblate (Italian) (ali.ciloqlu@murena.io)
  - Translated using Weblate (Czech) (pavel.borecki@gmail.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Czech) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Georgian) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.29.53-1
changelog:
  - docs: add caution for certificate_algorithms configuration (CCT-2704)
    (jsefler@redhat.com)
  - chore: Added more debug prints about closing connections (jhnidek@redhat.com)
  - fix: Set timeout before trying to close TLS connection (jhnidek@redhat.com)
  - fix(test): Update StubUEP updateConsumer() (jhnidek@redhat.com)
  - feat(pqc): update crypto capabilities from 'refresh' command
    (jlocash@redhat.com)
  - feat(pqc): update crypto capabilities from 'identity --regenerate' command
    (jlocash@redhat.com)
  - style: fix flake8 lint error (jlocash@redhat.com)
  - test: Fixed one unit test related to inotify (jhnidek@redhat.com)
  - feat(pqc): update crypto capabilities in candlepin from rhsmcertd-worker
    (jlocash@redhat.com)
  - fix: Do not send JSON document with empty signature (jhnidek@redhat.com)
  - chore: style formatting fixes in rhsmcertd worker (jajerome@redhat.com)
  - fix: updated rhsmcertd to detect when auto-registration is terminated early
    (jajerome@redhat.com)
  - fix: updated rhsmcertd to detect when system is already registered
    (jajerome@redhat.com)
  - feat(pqc): implement cache for crypto capabilities (jlocash@redhat.com)
  - fix(unit-tests): mock isdir so rhsm_debug tests are env agnostic
    (csnyder@redhat.com)
  - fix(test): Fixed unit tests to be compatible with 1.29 branch
    (jhnidek@redhat.com)
  - fix(pqc): update warning to indicate fallback (jlocash@redhat.com)
  - fix(pqc): raise RuntimeError when get_signature_algorithms or
    get_public_key_algorithms throw (jlocash@redhat.com)
  - feat(pqc): print warning when setting invalid `certificate_algorithms` value
    (jlocash@redhat.com)
  - docs: Document `rhsm.certificate_algorithms` config option in rhsm.conf man
    pages (jlocash@redhat.com)
  - fix: drop __smoke_test__ and __main__ from pqc.py (jlocash@redhat.com)
  - style: fix linting error in connection.py (jlocash@redhat.com)
  - test: fix broken tests for registerConsumer (jlocash@redhat.com)
  - feat(pqc): Use C bindings to retrieve public-key and signature algorithms in
    pqc.py (jlocash@redhat.com)
  - feat: POC: Add support for PQC (jhnidek@redhat.com)
  - test: Added C unit tests of _certificate.so (jhnidek@redhat.com)
  - feat: Added .pyi file for certificate.c (jhnidek@redhat.com)
  - chore: Not all .py* files should be ignored (jhnidek@redhat.com)
  - test: Created unit tests for certificate.c (jhnidek@redhat.com)
  - feat: Added 2 methods for listing crypto algorithms (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.54-1
changelog:
  - fix: Invalidate and update CurrentOwnerCache when owner change is detected
    (csnyder@redhat.com)
  - ci: bump actions/checkout from 6 to 7
    (49699333+dependabot[bot]@users.noreply.github.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.55-1
changelog:
  - fix: Invalidate CurrentOwnerCache when managerlib.persist_consumer_cert used
    (csnyder@redhat.com)
  - fix: set exit code during subscription-manager config
    --rhsm.certificate_algorithms (jlocash@redhat.com)


author: José Expósito <jexposit@redhat.com> - 2.4.123-2
changelog:
  - Revert upstream commit ffaa3ce144be ("2.4.122, Build Intel on all arches")
    libpciaccess is not available in RHEL 9 aarch64, ppc64le and s390x
    Resolves: https://issues.redhat.com/browse/RHEL-53869


author: DJ Delorie <dj@redhat.com> - 3.4.2-8
changelog:
  - Use /etc/sysconfig/libffi-force-shared-memory-check-first to
    override selinux permissions check for shared memory access (#2152228)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-4
changelog:
  - Backport ppc hardware flags detection (#2051307)
  - Disable PKCS#1.5 encryption in FIPS mode (#2061328)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-5
changelog:
  - Allow signature verification with smaller RSA keys (#2083846)
  - Allow short salt for KDF (#2114870)
  - Reseed the kernel DRBG by using GRND_RANDOM (#2118695)
  - Address FIPS review comments around selftests (#2118695)
  - Disable RSA-OAEP in FIPS mode (#2118695)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-6
changelog:
  - Fix SHA3 digests with large inputs (#2129150)
  - Fix FIPS RSA PCT (#2128455)
  - Fix RSA FIPS Keygen that non-deterministically fails (#2130275)
  - Get max 32B from getrandom in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-7
changelog:
  - Properly enforce KDF limits in FIPS mode (#2130275)
  - Fix memory leak in large digest test (#2129150)
  - Fix function name FIPS service indicator by disabling PK encryption and decryption (#2130275)
  - Skip RSA encryption/decryption selftest in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-8
changelog:
  - Fix unneeded PBKDF2 passphrase length limitation in FIPS mode
  - Enforce HMAC key lengths in MD API in FIPS mode


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-9
changelog:
  - Avoid usage of invalid arguments sizes for PBKDF2 in FIPS mode
  - Do not allow large salt lengths with RSA-PSS padding
  - Disable X9.31 key generation in FIPS mode
  - Update the FIPS integrity checking code to upstream version
  - Update cipher modes FIPS indicators for AES WRAP and GCM
  - Disable jitter entropy generator


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-10
changelog:
  - Provide FIPS indicators for MD and HMACs
  - Improve PCT tests for ECDSA and always run them after key is generated
  - Add missing guards for FIPS status in md_sign/verify function
  - Provider FIPS indicators for public key operation flags


author: Richard Hughes <richard@hughsie.com> 0.3.2-1
changelog:
  - New upstream version
  - Do not use deprecated libusb API
  - Use a 1ms timeout in the Windows event thread


author: Richard Hughes <richard@hughsie.com> 0.3.3-1
changelog:
  - New upstream version
  - Add a thin glib wrapper around libusb_endpoint_descriptor
  - Fix high number of wakeups when checking the GUsbContext


author: Richard Hughes <richard@hughsie.com> 0.3.4-1
changelog:
  - New upstream version
  - Include the USB bus in the generated platform_id
  - Validate the exported symbol list during check


author: Richard Hughes <richard@hughsie.com> 0.3.5-1
changelog:
  - New upstream version
  - Add a way to get iConfiguration
  - Allow building GtkDoc when building as a subproject


author: Richard Hughes <richard@hughsie.com> 0.3.6-1
changelog:
  - New upstream version
  - Add g_usb_device_get_string_descriptor_bytes()
  - Fix cancellation if cancellable is already cancelled


author: Richard Hughes <richard@hughsie.com> 0.3.8-1
changelog:
  - New upstream version
  - Add new API requested by fwupd
  - Add the GUsbEndpoint methods to the docs
  - Fix hotplug handling and signal emission during enumerate
  - Do not double-reference USB devices
  - Resolves: rhbz#1965885


author: Jeff Law <law@redhat.com> - 2.3.0-3
changelog:
  - Touch a couple autoconf related files to prevent undesired rebuilding
    if %configure changes one or more configure files.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-1
changelog:
  - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7
  - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9]
  - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID
  - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9]
  - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-3
changelog:
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
  - Resolves: RHEL-103434 - cache_credentials = true not working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-4
changelog:
  - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
    Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted.


author: Tomas Halman <thalman@redhat.com> - 2.9.8-1
changelog:
  - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8
  - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites
  - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name 
  - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none'
  - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so
  - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges
  - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache


author: Iker Pedrosa <ipedrosa@redhat.com> - 2.9.9-1
changelog:
  - Resolves: RHEL-173741 - SSSD Rebase for RHEL 9.9
  - Resolves: RHEL-173740 - CVE-2026-6245 sssd: out-of-bounds read in the sssd
  - Resolves: RHEL-150439 - Poor performance of `BE_REQ_INITGROUPS` handling by 'sssd_be' (LDAP RFC2307, no nested groups)
  - Resolves: RHEL-143416 - Performance impact with enumerate in SSSD > 2.7.3
  - Resolves: RHEL-152067 - [RFE] SSSD PAM: Support Microsoft AD PKINIT authentication indicator (ms-pkca) for pam_gssapi_indicators_map
  - Resolves: RHEL-173742 - Man page update: man sssd_krb5_localauth_plugin – Missing disable = an2ln
  - Resolves: RHEL-173743 - Concurrent child processes trigger unnecessarily backtrace
  - Resolves: RHEL-173744 - Detect foreign security principals in AD group members and silently ignore them
  - Resolves: RHEL-156519 - GDM Support for IdM IdP feature and MFA [SSSD]


author: Justin Stephenson <jstephen@redhat.com> - 2.9.9-3
changelog:
  - Resolves: RHEL-192062 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
  - Resolves: RHEL-192072 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream release
  - Fall back to the AliasId for validation
  - Fix jcat_context_verify_blob() to use self verify for checksums


author: Sahana Prasad <sahana@redhat.com> - 1.2.1-1
changelog:
  - Update to upstream version 1.2.1
  - Remove patch fix MSG_MORE uasge as it is added upstream
  - Remove cppcheck dependency for rhel bz#1931518
  - Add a patch to fix fuzz tests


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-1
changelog:
  - Update to new upstream release 1.4.0
    Resolves: RHEL-5367
  - Add a patch to fix auxiliary tests in FIPS mode
    Resolves: RHEL-2405
  - Add a patch to zeroize kcapi-hasher for FIPS 140-3
    Resolves: RHEL-15112
  - Add a patch to allow overriding target file in kcapi-hasher
    Resolves: RHEL-15298


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
changelog:
  - Backport fixes for kcapi-hasher target option
    Related: RHEL-15298
  - Fix kcapi tests in FIPS mode
    Resolves: RHEL-2405


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-3
changelog:
  - Remove ansi_cprng test as new kernels don't support it
    Resolves: RHEL-242707
  - Add tag processing in AEAD decryption without ciphertext
    Resolves: RHEL-242667
  - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests
    on error in libkcapi's one-shot AIO path
    Resolves: RHEL-224815
  - CVE-2026-71227: Fix infinite loop denial of service in libkcapi
    _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
    Resolves: RHEL-224976
  - CVE-2026-71225: Fix IV reuse in libkcapi one-shot symmetric cipher chunking
    Resolves: RHEL-224704


author: Wen Liang <wenliang@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved from the main package
    to the utils sub package causing a file conflict on multilib systems between the
    old 32 bit main package and the new 64 bit utils sub package.


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.1-1
changelog:
  - Release 2.11.1
  - Ignore Packager documents when running ModuleIndex.update_from_*()
  - Add python overrides for XMD in PackagerV3
  - Add python override to ignore the GType return when reading packager files
  - Add PackagerV3.get_mdversion()


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-1
changelog:
  - Release 2.11.2
  - Extend read_packager_[file|string]() to support overriding the module name
    and stream.


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-2
changelog:
  - Fix issue with ModuleIndex when input contains only Obsoletes documents
  - Fix import issue when built with Python 2 support


author: Hangbin Liu <haliu@redhat.com> - 1.8-1
changelog:
  - 1.8 release (rhbz#1958933)
  - libndp,ndptool: use poll() instead of select()
  - libndp: avoid static buffer for debug string in ndp_sock_recv()
  - ndptool: avoid static buffer for string in ndptool
  - libndp: use thread local variables for static return arguments
  - ndptool: don't use static variable for local context in msgrcv_handler_func()
  - ndptool: fix printing dnssl lifetime in ndptool
  - ndptool: fix potential memory leak caused by strdup
  - ndptool: add -D dest support
  - libndp: fix nd_msg typo when setting target address
  - libndp: close sockfd after using to avoid handle leak
  - ndptool: fix target parameter typo
  - ndptool: add -T target support


author: Phil Sutter <psutter@redhat.com> - 1.0.9-1
changelog:
  - expect/conntrack: Avoid spurious covscan overrun warning
  - conntrack: fix build with kernel 5.15 and musl
  - New version 1.0.9


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-32
changelog:
  - Undo 'Add explicit version requirement for libnfsidmap' from previous build (RHEL-78107)
  - Undo 'Add --disable-sbin-override for when /sbin is a symlink' from previous build (RHEL-69771)
  - Undo 'Move remaining binaries from /sbin to /usr/sbin' from previous build (RHEL-69771)


author: Steve Dickson <steved@redhat.com> 2.5.4-35
changelog:
  - nfs(5): Add new rdirplus functionality, clarify (RHEL-87143)
  - nfsd: allow more than 64 backlogged connections (RHEL-87752)


author: Steve Dickson <steved@redhat.com> 2.5.4-37
changelog:
  - gssd.man: add documentation for use-gss-proxy nfs.conf option (RHEL-85408)
  - gssd: do not use krb5_cc_initialize (RHEL-85412)


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-42
changelog:
  - Replace statfs64 with statfs (RHEL-127105)
  - NFS export symlink vulnerability fix (RHEL-127105)
  - mountd: Minor refactor of get_rootfh() (RHEL-127105)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127105)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127105)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127105)
  - Add requires for selinux-policy (RHEL-127105)
    Resolves: CVE-2025-12801


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-43
changelog:
  - nfsrahead: enable event-driven mountinfo monitoring and skip non-NFS devices (RHEL-158527)
  - nfsrahead: zero-initialise device_info struct (RHEL-158527)
  - nfsrahead: quieten misleading error for non-NFS block devices (RHEL-158527)


author: Phil Sutter <psutter@redhat.com> [1.2.6-1.el9]
changelog:
  - set: Do not leave free'd expr_list elements in place (Phil Sutter) [RHEL-14149]
  - Rebase onto version 1.2.6 (Phil Sutter) [RHEL-14149]


author: Phil Sutter <psutter@redhat.com> [1.2.6-3.el9]
changelog:
  - tests: Fix objref test case (Phil Sutter) [RHEL-28515]
  - expr: Respect data_len when setting attributes (Phil Sutter) [RHEL-28515]
  - obj: Respect data_len when setting attributes (Phil Sutter) [RHEL-28515]
  - utils: Introduce and use nftnl_set_str_attr() (Phil Sutter) [RHEL-28515]
  - obj: Enforce attr_policy compliance in nftnl_obj_set_data() (Phil Sutter) [RHEL-28515]
  - obj: Introduce struct obj_ops::attr_policy (Phil Sutter) [RHEL-28515]
  - obj: Call obj_ops::set with legal attributes only (Phil Sutter) [RHEL-28515]
  - obj: Repurpose struct obj_ops::max_attr field (Phil Sutter) [RHEL-28515]
  - obj: Return value on setters (Phil Sutter) [RHEL-28515]
  - object: getters take const struct (Phil Sutter) [RHEL-28515]
  - utils: Fix for wrong variable use in nftnl_assert_validate() (Phil Sutter) [RHEL-28515]
  - obj: synproxy: Use memcpy() to handle potentially unaligned data (Phil Sutter) [RHEL-28515]
  - obj: Do not call nftnl_obj_set_data() with zero data_len (Phil Sutter) [RHEL-28515]
  - table: Validate NFTNL_TABLE_OWNER, too (Phil Sutter) [RHEL-28515]
  - set: Validate NFTNL_SET_ID, too (Phil Sutter) [RHEL-28515]
  - obj: Validate NFTNL_OBJ_TYPE, too (Phil Sutter) [RHEL-28515]
  - flowtable: Validate NFTNL_FLOWTABLE_SIZE, too (Phil Sutter) [RHEL-28515]
  - table: Validate NFTNL_TABLE_USE, too (Phil Sutter) [RHEL-28515]
  - chain: Validate NFTNL_CHAIN_USE, too (Phil Sutter) [RHEL-28515]
  - expr: Enforce attr_policy compliance in nftnl_expr_set() (Phil Sutter) [RHEL-28515]
  - expr: Introduce struct expr_ops::attr_policy (Phil Sutter) [RHEL-28515]
  - include: Sync nf_log.h with kernel headers (Phil Sutter) [RHEL-28515]
  - expr: Call expr_ops::set with legal types only (Phil Sutter) [RHEL-28515]
  - expr: Repurpose struct expr_ops::max_attr field (Phil Sutter) [RHEL-28515]
  - udata: incorrect userdata buffer size validation (Phil Sutter) [RHEL-28515]
  - obj: ct_timeout: setter checks for timeout array boundaries (Phil Sutter) [RHEL-28515]
  - set_elem: use nftnl_data_cpy() in NFTNL_SET_ELEM_{KEY,KEY_END,DATA} (Phil Sutter) [RHEL-28515]
  - set: buffer overflow in NFTNL_SET_DESC_CONCAT setter (Phil Sutter) [RHEL-28515]
  - expr: fix buffer overflows in data value setters (Phil Sutter) [RHEL-28515]


author: Jan Macku <jamacku@redhat.com> 1.43.0-8
changelog:
  - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)


author: José Expósito <jexposit@redhat.com> - 0.16-7
changelog:
  - Fix findings from static application security testing (SAST)
    Resolves: https://issues.redhat.com/browse/RHEL-29753


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-13
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131594)
  - CVE-2025-65018: heap buffer overflow (RHEL-131603)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-14
changelog:
  - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356)
  - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-17
changelog:
  - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161456)


author: Tomáš Mráz <tmraz@redhat.com> 1.4.3-1
changelog:
  - Multiple translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-2
changelog:
  - Resolves rhbz#1919026 libpwquaily rpm requires cracklib-dict to function but RPM missing requirement


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Reposync does not re-download unchanged packages (RhBug:1931904)
  - Return "calculated" checksum if requested w/caching
  - Fixed memory leaks and segfault


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.5-1
changelog:
  - Update to 1.14.5
  - Detailed error message when using non-existing TMPDIR (RhBug:2019993)
  - Make error messages about repodata and rpm mismatch more user friendly


author: Petr Pisar <ppisar@redhat.com> - 0.0.3-8
changelog:
  - Correct a License tag to LGPLv2+ (RHEL-16103)
  - Fix relocating certificate paths to /etc/rhsm-host (RHEL-14224)


author: Neal Gompa <ngompa13@gmail.com> - 2.4.2-2
changelog:
  - Modernize spec
  - Backport fix for missing __SNR_ppoll symbol (#1777889)
  - Refresh patch to build on aarch64 with upstream version


author: Vit Mojzis <vmojzis@redhat.com> - 3.6-4
changelog:
  - Ignore files removed during relabeling (RHEL-123884)
  - Ignore directories removed during relabeling (RHEL-123884)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3-3
changelog:
  - allow spaces in user/group names (#2049665)
  - Fall back to semanage_copy_dir when rename() fails (#2068085)


author: Than Ngo <than@redhat.com> - 1.1.19-5
changelog:
  - Add sysusers.d config file to allow rpm to create users/groups automatically
    Resolves: RHEL-86310


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.22-1
changelog:
  - Update to 0.7.22
  - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
  - support zstd compressed control files in debian packages
  - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20)
  - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata
  - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck
  - support solv files with an idarray block
  - allow accessing the toolversion at runtime
  - support parsing of Debian's Multi-Arch indicator
  - fix segfault on conflict resolution when using bindings
  - fix split provides not working if the update includes a forbidden vendor change
  - reworked choice rule generation to cover more usecases
  - support SOLVABLE_PREREQ_IGNOREINST in the ordering code


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.24-1
changelog:
  - Update to 0.7.24
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Petr Pisar <ppisar@redhat.com> - 0.7.24-3
changelog:
  - Some static analysis fixes for unitialized structs
    Resolves: RHEL-25498
  - Fix a memory leak in parse_package() of repo conda (RHEL-25496)


author: Marek Blaha <mblaha@redhat.com> - 0.7.24-5
changelog:
  - Backport "choice rules: also do solver_choicerulecheck for package downgrades"
    Resolves: RHEL-141449


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-4
changelog:
  - Move loglevel closer to openssh loglevel
  - Add openssh config feature of +,-,^ for algorithm lists
  - Fix memory leaks of bignum
  - Prevent multiple expansion of escape characters
  - Resolves: rhbz#2132407, rhbz#2137839, rhbz#2144795, rhbz#2136824


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-6
changelog:
  - Fix covscan error
  - Remove unwanted test with yet unimplemented feature
  - Related: rhbz#2137839, rhbz#2136824


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-9
changelog:
  - Fix CVE-2023-1667 and CVE-2023-2283
  - Fix issues found by cosvcan
  - Resolves: rhbz#2182252, rhbz#2189740


author: Sahana Prasad <sahana@redhat.com> - 0.10.4-12
changelog:
  - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol (BPP)
  - Fix CVE-2023-6918 Missing checks for return values for digests
  - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection
    of malicious code through hostname
  - Resolves: RHEL-19310, RHEL-19691, RHEL-17245


author: Sahana Prasad <sahana@redhat.com> - 0.10.4-13
changelog:
  - Bump up the version so that the version in 9.3 is lower.
  - Resolves: RHEL-19310, RHEL-19691, RHEL-17245


author: Pavol Žáčik <pzacik@redhat.com> - 0.10.4-16
changelog:
  - Fix CVE-2025-5987
    Resolves: RHEL-130051
  - Workaround sshd failure rate limiting in tests
    Resolves: RHEL-135506


author: Pavol Žáčik <pzacik@redhat.com> - 0.10.4-18
changelog:
  - Resolves: RHEL-150661
  - Resolves: CVE-2025-4877
  - Resolves: CVE-2025-4878
  - Resolves: CVE-2025-5351
  - Resolves: CVE-2025-8114
  - Resolves: CVE-2025-8277
  - Resolves: CVE-2026-0964
  - Resolves: CVE-2026-0965
  - Resolves: CVE-2026-0966
  - Resolves: CVE-2026-0967
  - Resolves: CVE-2026-0968


author: Pavol Žáčik <pzacik@redhat.com> - 0.10.4-19
changelog:
  - Backport CVE patches from 0.11.5
    Resolves: RHEL-213033
    Resolves: RHEL-213041
    Resolves: RHEL-213047
    Resolves: RHEL-213081
    Resolves: RHEL-213114
    Resolves: RHEL-213119
    Resolves: RHEL-213151


author: Christopher Engelhard <ce@lcts.de> - 2.1.1-1
changelog:
  - Update to 2.1.1
  - Remove all patches merged upstream
  - Switched build to autotools
  - Include upstream pkgconfig module
  - Sysfsutils no longer includes /usr/bin/get_module


author: Jiri Pirko <jiri@resnulli.us> - 1.31-1
changelog:
  1.31 release
  utils/bond2team: remove TYPE in ifcfg file
  utils/bond2team: keep delivering config to file if stdout not supplied
  teamd/lacp: silence ignore none LACP frames
  teamd: fix ctx->hwaddr value assignment
  Send LACP PDU right after the Actor state has been changed
  Skip setting the same hwaddr to a lag port if not needed
  Make all netlink socket RCVBUF sizes configurable
  Don't return an error when timerfd socket return 0
  Fix ifinfo_link_with_port race condition with newlink
  teamd: fix possible race in master ifname callback


author: Hangbin Liu <haliu@redhat.com> - 1.31-8
changelog:
  - Build util team2bond in teamd rpm [1986788]
  - Add some cautions to util team2bond [1986788]
  - Add team2bond man doc [1986788]


author: Long Xin <lxin@redhat.com> - 1.31-16
changelog:
  - fix the Requires package name for teamd-devel
  - teamd: stop iterating callbacks when a loop restart is requested (rhbz#2148852)


author: Steve Dickson <steved@redhat.com> - 1.3.3-1
changelog:
  - bindresvport.c: fix a potential resource leakage (bz 2135405)
  - clnt_raw.c: fix a possible null pointer dereference (bz 2138317)


author: Mike FABIAN <mfabian@redhat.com> - 0.9.10-12
changelog:
  - Fix memory leak in vasnprint. Resolves: rhbz#1938800
    (Backported from upstream: https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4d288a80bf7ebe29334b9805cdcc70eacb6059c1)


author: Benjamin Berg <bberg@redhat.com> - 1.0.25-1
changelog:
  - Update to 1.0.25
  - Fix a crash after libusb_exit API has been misused
  - Add patchset to fix covscan reports
    Resolves: #1938801


author: Benjamin Berg <bberg@redhat.com> - 1.0.26
changelog:
  - Pull in new upstream libusb containing important regression fixes
    Resolves: #2058730
    Resolves: #1938801


author: Kate Hsuan <hpa@redhat.com> - 1.0.30-1
changelog:
  - Update to upstream version 1.0.30 to include the major bug fixes
  - Include the necessary API for fwupd backporting to RHEL9.
    Resolves: RHEL-182598


author: Tomas Halman <thalman@redhat.com> - 0.63-5
changelog:
  - Enable audit library in the build
  - Resolves: rhbz#1923043 - libuser doesn't audit events around the account lifecycle


author: David King <dking@redhat.com> - 2.9.13-10
changelog:
  - Fix CVE-2025-6021 (RHEL-96507)
  - Fix CVE-2025-49794 (RHEL-96405)
  - Fix CVE-2025-49796 (RHEL-96431)


author: Richard Hughes <richard@hughsie.com> 0.1.14-1
changelog:
  - New upstream release
  - Do not use libuuid
  - Ignore adaptors added with xb_builder_source_add_converter()


author: Richard Hughes <richard@hughsie.com> 0.1.15-1
changelog:
  - New upstream release
  - Add xb_builder_source_add_simple_adapter()
  - Allow reversing the query results


author: Richard Hughes <richard@hughsie.com> 0.2.0-1
changelog:
  - New upstream release which breaks API and ABI
  - Add the missing TEXT:INTE XPath support
  - Add variant of xb_silo_query_with_root() avoiding XbNode creation
  - Add XB_BUILDER_SOURCE_FLAG_WATCH_DIRECTORY flag
  - Allow specifying the node cache behaviour for the query
  - Avoid recursion when setting flags if possible
  - Avoid using weak pointers when building the silo
  - Do not allocate opcodes individually
  - Do not show a critical warning for invalid XML
  - Do not unconditionally create GTimer objects
  - Do not use the node cache when building indexes
  - Lazy load more arrays to reduce RSS usage


author: Richard Hughes <richard@hughsie.com> 0.2.1-1
changelog:
  - New upstream release
  - Do not assume g_content_type_guess() always returns valid results
  - Fix getting translated results in gnome-software
  - Update the header location to reflect the new API


author: Richard Hughes <richard@hughsie.com> 0.3.0-1
changelog:
  - New upstream release
  - Add a new object to contain query context data
  - Allow collapsing empty XML tags if no children or text
  - Allow marking elements as tokenized from xb-tool
  - Allow optimized searching when comparing tokens
  - Cancel the GFileMonitor before unreffing it
  - Do not allocate a 128Mb buffer for each xb_builder_source_ctx_get_bytes()
  - Do not error when creating a query if the element doesn’t exist
  - Fix a parse failure for a double comment
  - Fix various errors or missing annotations in docs
  - Make handling of single-result queries more robust
  - Support mmap()ing the source file to get bytes
  - Support query caching with xb_silo_lookup_query()
  - Support UTF-8 for upper-case() and lower-case()
  - Use g_str_match_string() for non-ASCII search queries
  - Write search tokens into the built silo


author: Richard Hughes <richard@hughsie.com> 0.3.3-1
changelog:
  - New upstream release
  - Add locking for file monitors
  - Add support for LZMA decompression
  - Clarify GMainContext usage and signal emission
  - Respect XB_BUILDER_NODE_FLAG_IGNORE when exporting
  - Use the chosen chunk size when reading from a stream
  - Use the correct pkgconfig export package name in the GIR file
  - Always run xb-tool queries with the optimizer
  - Ensure tokens handling works when XbOpcode is not zero-inited
  - Use stack-allocated XbStack instances for running a machine
  - Resolves: rhbz#1965891


author: Neal Gompa <ngompa@centosproject.org> - 0.3.10-1
changelog:
  - New upstream release
  - Fix dumping and exporting multiple files from the CLI
  - Watch files before loading them into the builder
  - Fix potential double free when filtering by language
  - Fix the crash for when the root tree has no children
  - Fix the crash when getting the element for the [empty] root
  - Install xb-tool into bindir
  - Ensure reproducible results when importing a node
  - Ignore all hidden files when using _WATCH_DIRECTORY
  - Show the value bindings when using XB_SILO_PROFILE_FLAG_XPATH
  - Ensure _IS_TOKENIZED is set if tokens are added manually
  - Ensure we never add too many tokens to the silo
  - Put tail after the node when exporting XbBuilderNode
  - Remove the G_ALIGNOF checks to fix compile with old GLib versions
  - Add a flag to require the XbBuilderSource to have no siblings
  - Add iterator for XbNode attributes and children
  - Allow removing XbBuilderNode text
  - Allow stripping builder node inner text
  - Resolves: rhbz#2134794


author: RHEL Packaging Agent <jotnar@redhat.com> - 0.3.24-1
changelog:
  - Rebase to 0.3.24
  - Add missing libzstd-devel BuildRequires
  - Add missing files to the %files tests section
  - Resolves: RHEL-116442


author: John Eckersberg <jeckersb@redhat.com> - 0.2.5-4
changelog:
  - Add BuildRequires for make
    (re: https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot)


author: Michel Alexandre Salim <salimma@centosproject.org> - 1.5.1-1
changelog:
  - Rebase to the latest upstream version
  - Enable optional gz, xz/lzma, and lz4 support in the zstd tool
  - Disable amd64 assembly on non-x86_64 architectures (rhbz#2035802)
    this should avoid the issue where an executable stack is created
  - Re-enable CET protections (rhbz#2039353)
    Resolves: rhbz#2039488


author: Vit Mojzis <vmojzis@redhat.com> - 1.0.18-3
changelog:
  - Added a patch to fix netinet/sctp.h not to be installed.
  - Added some fixes for kernel feature detection.
  - Updated to 1.0.18. [1568622]


author: Hangbin Liu <haliu@redhat.com> - 1.1.1-1.gitf1dd9eb
changelog:
  - Rebase to 1.1.1
  - Fix program segfaults after entering the quit command (RHEL-5814)
  - Fix setting interface status not survive reboot (RHEL-5824)
  - Fix some other bugs


author: Hangbin Liu <haliu@redhat.com> - 1.1.1-3.gitf1dd9eb
changelog:
  - Rebase to latest upstream code
  - Remove interface configure if the interface deleted (RHEL-13242)
  - Fix strdup is not freed (RHEL-37524)
  - Fix using uninitialized value (RHEL-37548)
  - Fix copy past error (RHEL-37679)
  - Fix resource leak (RHEL-37685)


author: Konrad Kleine <kkleine@redhat.com> - 19.1.5-1
changelog:
  - Update to 19.1.5
  - Enable LLVM_ENABLE_ZSTD (rhbz#2321848)
  - Remove HTML documentation
  - Add lldb man pages
  - Fix profiling after a binutils NOTE change (rhbz#2322754)
  - Install i386 config files on x86_64


author: Kamil Dudka <kdudka@redhat.com> - 3.18.0-4
changelog:
  - make `renamecopy` and `copytruncate` override each other (#1934601)
  - unify documentation of copy/copytruncate/renamecopy (#1934629)
  - fix resource leaks reported by Coverity


author: Paul Evans <pevans@redhat.com> - 0.32-7
changelog:
  - lsscsi: Fixes for SBP (Firewire) host in transport_h_init() (RHEL-164341)
  - lsscsi: Change default output trailing space after each device entry (RHEL-164345)
  - lsscsi: Transport type FC and FCOE output inconsistencies (RHEL-84793)
  - lsscsi: Device name spacing before major:minor when dev name exceeds 9 chars (RHEL-157864)


author: Than Ngo <than@redhat.com> - 1.7.14-3
changelog:
  - Resolves: #2181241, lsvpd is not reporting the correct I/O microcode
    for HBA, PCIe, SAS adapters, HDD, etc


author: Than Ngo <than@redhat.com> - 1.7.14-4
changelog:
  - Related: #2181241, backport upstream patch to update update nvme_templates
    with logpage format for 0005 and 0006 versions


author: Than Ngo <than@redhat.com> - 1.7.17-1
changelog:
  - Resolves: RHEL-115187, Enhance lsvpd to update VPD for Nvidia OTS Adapters
  - Resolves: RHEL-102476, Update to 1.7.17


author: Tom Callaway <spot@fedoraproject.org> - 5.4.0-4
changelog:
  - apply upstream fix for CVE-2020-15889
  - apply upstream fix for CVE-2020-15945
  - apply upstream fixes for "known bugs"


author: DJ Delorie <dj@redhat.com> - 1:4.3-5
changelog:
  - Allow users to build with or without guile support as desired.
  - Allow derivative downstreams to default to disabling guile support.


author: Patsy Griffin <patsy@redhat.com> - 6.04-4
changelog:
  - Activate previously added patch to improve mktime documentation and
    add 3 related upstream patches including an example.
    Related: RHEL-58342


author: Patsy Griffin <patsy@redhat.com> - 6.04-7
changelog:
  - Break up man-pages-additional-20140218.tar.xz
  - Add rtas.2, swapcontext.2 and cons.saver.8 man pages as a patch.
    Resolves: RHEL-101596


author: Patsy Griffin <patsy@redhat.com> - 6.04-10
changelog:
  - suffixes(7): Add zstd format to the suffixes file
  - core(5): Document dump file format change from lz4 format to zstd format
    Resolves: RHEL-152440


author: Xiao Ni <xni@redhat.com> - 4.2-7
changelog:
  - Update to latest upstream and keep udev rule close to upstream
  - Resolves rhbz#2107147, rhbz#2129087, rhbz#2126428


author: Xiao Ni <xni@redhat.com> - 4.2-8
changelog:
  - Update to latest upstream
  - Resolves rhbz#2127101, rhbz#2139789, rhbz#2149292, rhbz#2151209, rhbz#2148945


author: Xiao Ni <xni@redhat.com> - 4.2-9
changelog:
  - Update to latest upstream and fix mdcheck service bug
  - Resolves rhbz#2159923, rhbz#2150865, rhbz#2124071, rhbz#2203859


author: Nicola Sella <nsella@redhat.com> - 3.5.0-1
changelog:
  - Update to 3.5.0
  - Add module enable and disable commands
  - Add reports of module changes
  - Add "module enable" command
  - Add subcommands support
  - Print info about obsoleted packages before transaction (RhBug:1855542)


author: Nicola Sella <nsella@redhat.com> - 3.6.0-1
changelog:
  - Update to 3.6.0
  - spec: Sync summary and description from openSUSE
  - Add support for setting a platform module ID
  - Add dependency for DNF configurations skeleton
  - Add support for setting allow_vendor_change


author: Nicola Sella <nsella@redhat.com> - 3.7.1-1
changelog:
  - Update to 3.7.1
  - [download] fix: unwanted dependency on newer glib 
  - [download] Support for "--resolve" and "--alldeps" arguments 
  - [download] New get_packages_query function
  - Support "--setopt=keepcache=0/1"
  - [download] Support "--archlist=" argument
  - [download] Move package download code to "download_packages" function
  - [download] several optimizations
  - Don't set default value of "assumeyes" to TRUE 
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Extend "--setopt" to support repository options 
  - Added alias "update" to "upgrade" command
  - Command "update" renamed to "upgrade"
  - Add support for command aliases
  - dnf-data requirement only for Fedora and future RHEL
  - Relicense to GPLv2+ [errata corrige: not in 3.5.1-1]
  - Sync summary and description from openSUSE [errata corrige: not in 3.6.0-1]


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - distrosync: Fix style issues and plugin build with Meson 
  - Add distro-sync subcommand
  - Add "makecache" command


author: Lukas Hrazky <lhrazky@redhat.com> - 3.9.1-1
changelog:
  - Update to 3.9.1
  - leaves: Treat recommends as dependencies when install_weak_deps=True
  - Add leaves command
  - Remove non-breaking space from "Size" column (RhBug:2010676)


author: Nicola Sella <nsella@redhat.com> - 3.9.1-2
changelog:
  - Revert: leaves: Treat recommends as dependencies when install_weak_deps=True
  - Revert: Add leaves command


author: Tomas Popela <tpopela@redhat.com> - 0.26-27
changelog:
  - Don't prune bind mounts on ostree based systems, prune the deployments folder
    there to avoid duplications.
  - Fixes: https://github.com/fedora-silverblue/issue-tracker/issues/76


author: Pavel Cahyna <pcahyna@redhat.com> - 4.0.26-4
changelog:
  - Add dependency on glibc-gconv-extra
    mtools need codepage 850, which was split from glibc into a subpackage.
    (Fedora bug #2021637, RHEL bug #2073843)


author: Robert Scheck <robert@fedoraproject.org> - 2:0.94-1
changelog:
  - Rebase to 0.94 (#1742473, #1840079)
  - Drop policykit wrapper for xmtr due to libcap (#1488417, #1488418)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.2-9.20210508
changelog:
  - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491)
  - ignore TERMINFO and HOME environment variables if running as root (#2211666)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-14.20191109
changelog:
  - update to 6.1-20191109
  - remove LDFLAGS from pkgconfig files and ncurses-config scripts (#1771137)


author: Fedora Release Engineering <releng@fedoraproject.org> - 6.2-4.20200222
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
  - Use make macros
  - Remove MIT definition
  - Add BuildRequires: make


author: Phil Sutter <psutter@redhat.com> [1.0.9-1.el9]
changelog:
  - spec: Utilize pyproject-rpm-macros for the python sub-package (Phil Sutter) [RHEL-14191]
  - Rebase onto version 1.0.9 (Phil Sutter) [RHEL-14191]


author: Phil Sutter <psutter@redhat.com> [1.0.9-4.el9]
changelog:
  - parser_json: fix handle memleak from error path (Phil Sutter) [RHEL-88181]
  - json: deal appropriately with multidevice in chain (Phil Sutter) [RHEL-88181]


author: Phil Sutter <psutter@redhat.com> [1.0.9-5.el9]
changelog:
  - tests: py: missing json output in never merge across non-expression statements (Phil Sutter) [RHEL-114095]
  - tests: py: add missing json.output data (Phil Sutter) [RHEL-114095]
  - tests: py: remove huge-limit test cases (Phil Sutter) [RHEL-114095]
  - datatype: rt_symbol_table_init() to search for iproute2 configs (Phil Sutter) [RHEL-114095]
  - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-114095]
  - tests: shell: Fix sets/reset_command_0 for current kernels (Phil Sutter) [RHEL-114095]


author: Phil Sutter <psutter@redhat.com> [1.0.9-6.el9]
changelog:
  - Revert doc/ part of "exthdr: add boolean DCCP option matching" (Phil Sutter) [RHEL-126817]
  - Revert doc/ part of "meta: introduce meta broute support" (Phil Sutter) [RHEL-126817]
  - Revert doc/ part of "src: add tcp option reset support" (Phil Sutter) [RHEL-126817]
  - spec: Update expected test suite results (Phil Sutter) [RHEL-126817]


author: Phil Sutter <psutter@redhat.com> [1.0.9-7.el9]
changelog:
  - src: fix reset element support for interval set type (Phil Sutter) [RHEL-153461]
  - src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-153461]


author: Phil Sutter <psutter@redhat.com> [1.0.9-8.el9]
changelog:
  - spec: Update expected test suite results (Phil Sutter) [RHEL-190549]
  - tests: monitor: Fix for out-of-path call (Phil Sutter) [RHEL-190549]
  - tests: monitor: Excercise all syntaxes and variants by default (Phil Sutter) [RHEL-190549]
  - tests: monitor: Test JSON echo mode as well (Phil Sutter) [RHEL-190549]
  - tests: monitor: Become $PWD agnostic (Phil Sutter) [RHEL-190549]
  - tests: monitor: Run in own netns (Phil Sutter) [RHEL-190549]
  - tests: monitor: Label diffs to help users (Phil Sutter) [RHEL-190549]
  - tests: monitor: Extend testcases a bit (Phil Sutter) [RHEL-190549]
  - tests: monitor: enclose device names in quotes (Phil Sutter) [RHEL-190549]
  - json: Dump flowtable hook spec only if present (Phil Sutter) [RHEL-190549]
  - tests: py: Fix some JSON equivalents (Phil Sutter) [RHEL-190549]
  - rule: constify set_is_non_concat_range() (Phil Sutter) [RHEL-190549]
  - datatype: don't return a const string from cgroupv2_get_path() (Phil Sutter) [RHEL-190549]
  - tests: py: Fix --keep test runner option (Phil Sutter) [RHEL-190549]
  - segtree: fix get element command with open intervals (Phil Sutter) [RHEL-190549]
  - segtree: replace default case by specific types in get_set_intervals() (Phil Sutter) [RHEL-190549]
  - src: remove EXPR_SET_ELEM in range_expr_value_{low,high}() (Phil Sutter) [RHEL-190549]
  - segtree: rename set_elem_add() to set_elem_expr_add() (Phil Sutter) [RHEL-190549]
  - parser_json: fix map/set type confusion crash in map statement parser (Phil Sutter) [RHEL-190549]
  - cache: honor -c/--check for reset commands (Phil Sutter) [RHEL-190549]
  - tests: py: osf is ip-only (Phil Sutter) [RHEL-190549]
  - tests: py: print the file name as intended (Phil Sutter) [RHEL-190549]
  - tests: py: don't use a fixed filename (Phil Sutter) [RHEL-190549]
  - mnl: Fix ordering of hooks in 'list hooks' output (Phil Sutter) [RHEL-190549]
  - segtree: Fix for variable-sized object may not be initialized (Phil Sutter) [RHEL-190549]
  - cache: Filter for table when listing flowtables (Phil Sutter) [RHEL-190549]
  - cache: Filter for table when listing sets or maps (Phil Sutter) [RHEL-190549]
  - cache: Respect family in all list commands (Phil Sutter) [RHEL-190549]
  - cache: Include chains, flowtables and objects in netlink debug output (Phil Sutter) [RHEL-190549]
  - cache: Relax chain_cache_dump filter application (Phil Sutter) [RHEL-190549]
  - parser_bison: add range check for synproxy wscale (Phil Sutter) [RHEL-190549]
  - json: complete multi-statement set element support (Phil Sutter) [RHEL-190549]
  - segtree: Fix range aggregation on Big Endian (Phil Sutter) [RHEL-190549]
  - mergesort: Align concatenation sort order with Big Endian (Phil Sutter) [RHEL-190549]
  - mergesort: Fix sorting of string values (Phil Sutter) [RHEL-190549]
  - tests: py: any/tcpopt.t.json: Fix JSON equivalent (Phil Sutter) [RHEL-190549]
  - expression: expr_build_udata_recurse should recurse (Phil Sutter) [RHEL-190549]
  - expression: propagate key datatype for anonymous sets (Phil Sutter) [RHEL-190549]
  - netlink_delinearize: also consider exthdr type when trimming binops (Phil Sutter) [RHEL-190549]
  - tcpopt: add symbol table for mptcp suboptions (Phil Sutter) [RHEL-190549]
  - monitor: fix memleak in setelem cb (Phil Sutter) [RHEL-190549]
  - tests: json_echo: Drop rule handle before multi-add (Phil Sutter) [RHEL-190549]
  - rule: skip CMD_OBJ_SETELEMS with no elements after set flush (Phil Sutter) [RHEL-190549]
  - doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-190549]
  - doc: don't suggest to disable GSO (Phil Sutter) [RHEL-190549]
  - tests: py: Implement payload_record() (Phil Sutter) [RHEL-190549]
  - tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-190549]
  - tests: py: Do not rely upon '[end]' marker (Phil Sutter) [RHEL-190549]
  - tests: py: Fix for using wrong payload path (Phil Sutter) [RHEL-190549]
  - tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-190549]
  - datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-190549]
  - optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-190549]
  - src: parser_json: fix format string bugs (Phil Sutter) [RHEL-190549]
  - doc: fix tcpdump example (Phil Sutter) [RHEL-190549]
  - tests: py: objects.t: must use input, not output (Phil Sutter) [RHEL-190549]
  - fib: Fix for existence check on Big Endian (Phil Sutter) [RHEL-190549]
  - tests: Prepare exit codes for automake (Phil Sutter) [RHEL-190549]
  - monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-190549]
  - monitor: Recognize flowtable add/del events (Phil Sutter) [RHEL-190549]
  - tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-190549]
  - monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-190549]
  - mnl: continue on ENOBUFS errors when processing batch (Phil Sutter) [RHEL-190549]
  - tests: monitor: Fix for flag arrays in JSON output (Phil Sutter) [RHEL-190549]
  - mnl: silence compiler warning (Phil Sutter) [RHEL-190549]
  - fib: restore JSON output for relational expressions (Phil Sutter) [RHEL-190549]
  - src: ensure chain policy evaluation when specified (Phil Sutter) [RHEL-190549]
  - segtree: incorrect type when aggregating concatenated set ranges (Phil Sutter) [RHEL-190549]
  - json: Do not reduce single-item arrays on output (Phil Sutter) [RHEL-190549]
  - tests: py: Fix tests added for 'icmpv6 taddr' support (Phil Sutter) [RHEL-190549]
  - tests: py: Drop stale entry from ip/snat.t.payload (Phil Sutter) [RHEL-190549]
  - tests: py: Drop stale entries from ip6/{ct,meta}.t.json (Phil Sutter) [RHEL-190549]
  - tests: py: Drop stale entry from ip/snat.t.json (Phil Sutter) [RHEL-190549]
  - tests: py: Drop duplicate test from inet/vxlan.t (Phil Sutter) [RHEL-190549]
  - tests: py: Drop stale entry from inet/tcp.t.json (Phil Sutter) [RHEL-190549]
  - tests: py: Drop duplicate test from inet/gretap.t (Phil Sutter) [RHEL-190549]
  - tests: py: Drop duplicate test from inet/gre.t (Phil Sutter) [RHEL-190549]
  - tests: py: Drop duplicate test from inet/geneve.t (Phil Sutter) [RHEL-190549]
  - tests: py: Drop stale entries since redundant test case removal (Phil Sutter) [RHEL-190549]
  - src: netlink: netlink_delinearize_table() may return NULL (Phil Sutter) [RHEL-190549]
  - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-190549]
  - mnl: Call mnl_attr_nest_end() just once (Phil Sutter) [RHEL-190549]
  - evaluate: validate set expression type before accessing flags (Phil Sutter) [RHEL-190549]
  - rule: print chain and flowtable devices in quotes (Phil Sutter) [RHEL-190549]
  - tests: py: re-enables nft-test.py to load the local nftables.py (Phil Sutter) [RHEL-190549]
  - fib: allow to use it in set statements (Phil Sutter) [RHEL-190549]
  - fib: allow to check if route exists in maps (Phil Sutter) [RHEL-190549]
  - tests: shell: Fix ifname_based_hooks feature check (Phil Sutter) [RHEL-190549]
  - json: reject too long interface names (Phil Sutter) [RHEL-190549]
  - tests/py: clean up set backend support fallout (Phil Sutter) [RHEL-190549]
  - cache: assert name is non-nul when looking up (Phil Sutter) [RHEL-190549]
  - parser_bison: only reset by name is supported by now (Phil Sutter) [RHEL-190549]
  - rule: skip fuzzy lookup if object name is not available (Phil Sutter) [RHEL-190549]
  - parser_bison: allow delete command with map via handle (Phil Sutter) [RHEL-190549]
  - debug: include kernel set information on cache fill (Phil Sutter) [RHEL-190549]
  - tests/py: prepare for set debug change (Phil Sutter) [RHEL-190549]
  - src: BASECHAIN flag no longer implies presence of priority expression (Phil Sutter) [RHEL-190549]
  - netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY attribute (Phil Sutter) [RHEL-190549]
  - tests: py: Properly fix JSON equivalents for netdev/reject.t (Phil Sutter) [RHEL-190549]
  - tests: shell: Adjust to ifname-based hooks (Phil Sutter) [RHEL-190549]
  - tests: shell: combine dormant flag with netdevice removal (Phil Sutter) [RHEL-190549]
  - tests: monitor: Fix for single flag array avoidance (Phil Sutter) [RHEL-190549]
  - netlink: Do not allocate a bogus flowtable priority expr (Phil Sutter) [RHEL-190549]
  - netlink: Fix for potential crash parsing a flowtable (Phil Sutter) [RHEL-190549]
  - json: work around fuzzer-induced assert crashes (Phil Sutter) [RHEL-190549]
  - json: prevent null deref if chain->policy is not set (Phil Sutter) [RHEL-190549]
  - tests: py: fix json single-flag output for fib & synproxy (Phil Sutter) [RHEL-190549]
  - tests: shell: check for features not available in 5.4 (Phil Sutter) [RHEL-190549]
  - netlink: Avoid potential NULL-ptr deref parsing set elem expressions (Phil Sutter) [RHEL-190549]
  - netlink: Catch unknown types when deserializing objects (Phil Sutter) [RHEL-190549]
  - json: Introduce json_add_array_new() (Phil Sutter) [RHEL-190549]
  - json: Fix for memleak in __binop_expr_json (Phil Sutter) [RHEL-190549]
  - json: Accept more than two operands in binary expressions (Phil Sutter) [RHEL-190549]
  - json: Print single fib flag as non-array (Phil Sutter) [RHEL-190549]
  - tests: shell: Add test case for JSON 'flags' arrays (Phil Sutter) [RHEL-190549]
  - json: Print single set flag as non-array (Phil Sutter) [RHEL-190549]
  - json: Print single synproxy flags as non-array (Phil Sutter) [RHEL-190549]
  - parser_json: Introduce parse_flags_array() (Phil Sutter) [RHEL-190549]
  - doc: Fix typo in nat statement 'prefix' description (Phil Sutter) [RHEL-190549]
  - netlink: bogus concatenated set ranges with netlink message overrun (Phil Sutter) [RHEL-190549]
  - parser_bison: add selector_expr rule to restrict typeof_expr (Phil Sutter) [RHEL-190549]
  - optimize: invalidate merge in case of duplicated key in set/map (Phil Sutter) [RHEL-190549]
  - evaluate: bail out if ct saddr/daddr dependency cannot be inserted (Phil Sutter) [RHEL-190549]
  - parser_json: bail out on malformed statement in set (Phil Sutter) [RHEL-190549]
  - parser_json: reject empty jump/goto chain (Phil Sutter) [RHEL-190549]
  - parser_json: allow statement stateful statement only in set elements (Phil Sutter) [RHEL-190549]
  - cache: prevent possible crash rule filter is NULL (Phil Sutter) [RHEL-190549]
  - optimize: expand expression list when merging into concatenation (Phil Sutter) [RHEL-190549]
  - cache: don't crash when filter is NULL (Phil Sutter) [RHEL-190549]
  - evaluate: only allow stateful statements in set and map definitions (Phil Sutter) [RHEL-190549]
  - evaluate: compact STMT_F_STATEFUL checks (Phil Sutter) [RHEL-190549]
  - json: don't BUG when asked to list synproxies (Phil Sutter) [RHEL-190549]
  - optimize: incorrect comparison for reject statement (Phil Sutter) [RHEL-190549]
  - optimize: compact bitmask matching in set/map (Phil Sutter) [RHEL-190549]
  - tests: shell: missing ct count elements in new set_stmt test (Phil Sutter) [RHEL-190549]
  - evaluate: don't update cache for anonymous chains (Phil Sutter) [RHEL-190549]
  - json: make sure timeout list is initialised (Phil Sutter) [RHEL-190549]
  - parser_bison: consolidate connlimit grammar rule for set elements (Phil Sutter) [RHEL-190549]
  - parser_bison: consolidate last grammar rule for set elements (Phil Sutter) [RHEL-190549]
  - parser_bison: consolidate quota grammar rule for set elements (Phil Sutter) [RHEL-190549]
  - parser_bison: consolidate limit grammar rule for set elements (Phil Sutter) [RHEL-190549]
  - parser_bison: consolidate counter grammar rule for set elements (Phil Sutter) [RHEL-190549]
  - tests: shell: extend coverage for set element statements (Phil Sutter) [RHEL-190549]
  - evaluate: fix assertion failure with malformed map definitions (Phil Sutter) [RHEL-190549]
  - evaluate: don't allow nat map with specified protocol (Phil Sutter) [RHEL-190549]
  - parser_bison: reject non-serializeable typeof expressions (Phil Sutter) [RHEL-190549]
  - netlink: fix stack buffer overrun when emitting ranged expressions (Phil Sutter) [RHEL-190549]
  - src: print set element with multi-word description in single one line (Phil Sutter) [RHEL-190549]
  - tests: shell: detach synproxy test (Phil Sutter) [RHEL-190549]
  - src: do not merge a set with a erroneous one (Phil Sutter) [RHEL-190549]
  - segtree: incomplete output in get element command with maps (Phil Sutter) [RHEL-190549]
  - evaluate: release existing datatype when evaluating unary expression (Phil Sutter) [RHEL-190549]
  - segtree: fix string data initialisation (Phil Sutter) [RHEL-190549]
  - payload: honor inner payload description in payload_expr_cmp() (Phil Sutter) [RHEL-190549]
  - payload: return early if dependency is not a payload expression (Phil Sutter) [RHEL-190549]
  - evaluate: optimize zero length range (Phil Sutter) [RHEL-190549]
  - fib: Change data type of fib oifname to "ifname" (Phil Sutter) [RHEL-190549]
  - evaluate: auto-merge is only available for singleton interval sets (Phil Sutter) [RHEL-190549]
  - parser_bison: compact and simplify list and reset syntax (Phil Sutter) [RHEL-190549]
  - parser_bison: turn redundant ip option type field match into boolean (Phil Sutter) [RHEL-190549]
  - datatype: clamp boolean value to 0 and 1 (Phil Sutter) [RHEL-190549]
  - tests: shell: delete netdev chain after test (Phil Sutter) [RHEL-190549]
  - ipopt: use ipv4 address datatype for address field in ip options (Phil Sutter) [RHEL-190549]
  - netlink_delinarize: fix bogus munging of mask value (Phil Sutter) [RHEL-190549]
  - evaluate: remove variable shadowing (Phil Sutter) [RHEL-190549]
  - intervals: do not merge intervals with different timeout (Phil Sutter) [RHEL-190549]
  - src: add EXPR_RANGE_VALUE expression and use it (Phil Sutter) [RHEL-190549]
  - intervals: add helper function to set previous element (Phil Sutter) [RHEL-190549]
  - parser_bison: fix UaF when reporting table parse error (Phil Sutter) [RHEL-190549]
  - intervals: set internal element location with the deletion trigger (Phil Sutter) [RHEL-190549]
  - optimize: compare expression length (Phil Sutter) [RHEL-190549]
  - tests: py: Fix for storing payload into missing file (Phil Sutter) [RHEL-190549]
  - json: Support typeof in set and map types (Phil Sutter) [RHEL-190549]
  - json: collapse set element commands from parser (Phil Sutter) [RHEL-190549]
  - doc: extend description of fib expression (Phil Sutter) [RHEL-190549]
  - tests: monitor: fix up test case breakage (Phil Sutter) [RHEL-190549]
  - src: fix extended netlink error reporting with large set elements (Phil Sutter) [RHEL-190549]
  - mnl: rename to mnl_seqnum_alloc() to mnl_seqnum_inc() (Phil Sutter) [RHEL-190549]
  - mnl: update cmd_add_loc() to take struct nlmsghdr (Phil Sutter) [RHEL-190549]
  - rule: netlink attribute offset is uint32_t for struct nlerr_loc (Phil Sutter) [RHEL-190549]
  - src: collapse set element commands from parser (Phil Sutter) [RHEL-190549]
  - libnftables-json: fix raw payload expression documentation (Phil Sutter) [RHEL-190549]
  - cache: initialize filter when fetching implicit chains (Phil Sutter) [RHEL-190549]
  - tests: py: fix up udp csum fixup output (Phil Sutter) [RHEL-190549]
  - proto: use NFT_PAYLOAD_L4CSUM_PSEUDOHDR flag to mangle UDP checksum (Phil Sutter) [RHEL-190549]
  - tests: shell: stabilize packetpath/payload (Phil Sutter) [RHEL-190549]
  - libnftables: Zero ctx->vars after freeing it (Phil Sutter) [RHEL-190549]
  - cache: position does not require full cache (Phil Sutter) [RHEL-190549]
  - cache: relax requirement for replace rule command (Phil Sutter) [RHEL-190549]
  - cache: remove full cache requirement when echo flag is set on (Phil Sutter) [RHEL-190549]
  - cache: assert filter when calling nft_cache_evaluate() (Phil Sutter) [RHEL-190549]
  - cache: consolidate reset command (Phil Sutter) [RHEL-190549]
  - cache: add filtering support for objects (Phil Sutter) [RHEL-190549]
  - cache: only dump rules for the given table (Phil Sutter) [RHEL-190549]
  - cache: accumulate flags in batch (Phil Sutter) [RHEL-190549]
  - cache: reset filter for each command (Phil Sutter) [RHEL-190549]
  - parser_json: fix several expression memleaks from error path (Phil Sutter) [RHEL-190549]
  - parser_json: release buffer returned by json_dumps (Phil Sutter) [RHEL-190549]
  - json: Support maps with concatenated data (Phil Sutter) [RHEL-190549]
  - parser_json: fix crash in json_parse_set_stmt_list (Phil Sutter) [RHEL-190549]
  - parser_bison: allow 0 burst in limit rate byte mode (Phil Sutter) [RHEL-190549]
  - datatype: improve error reporting when time unit is not correct (Phil Sutter) [RHEL-190549]
  - cache: rule by index requires full cache (Phil Sutter) [RHEL-190549]
  - datatype: reject rate in quota statement (Phil Sutter) [RHEL-190549]
  - optimize: skip variables in nat statements (Phil Sutter) [RHEL-190549]
  - parser_json: use stdin buffer if available (Phil Sutter) [RHEL-190549]
  - libnftables: skip useable checks for /dev/stdin (Phil Sutter) [RHEL-190549]
  - optimize: clone counter before insertion into set element (Phil Sutter) [RHEL-190549]
  - segtree: set on EXPR_F_KERNEL flag for catchall elements in the cache (Phil Sutter) [RHEL-190549]
  - evaluate: set on expr->len for catchall set elements (Phil Sutter) [RHEL-190549]
  - parser_bison: recursive table declaration in deprecated meter statement (Phil Sutter) [RHEL-190549]
  - intervals: fix element deletions with maps (Phil Sutter) [RHEL-190549]
  - src: add string preprocessor and use it for log prefix string (Phil Sutter) [RHEL-190549]
  - tests: shell: skip ip option tests if kernel does not support it (Phil Sutter) [RHEL-190549]
  - cmd: skip variable set elements when collapsing commands (Phil Sutter) [RHEL-190549]
  - cmd: provide better hint if chain is already declared with different type/hook/priority (Phil Sutter) [RHEL-190549]
  - monitor: too large shift exponent displaying payload expression (Phil Sutter) [RHEL-190549]
  - scanner: inet_pton() allows for broader IPv4-Mapped IPv6 addresses (Phil Sutter) [RHEL-190549]
  - evaluate: Fix incorrect checking the `base` variable in case of IPV6 (Phil Sutter) [RHEL-190549]
  - evaluate: bogus protocol conflicts in vlan with implicit dependencies (Phil Sutter) [RHEL-190549]
  - cache: check for NFT_CACHE_REFRESH in current requested cache too (Phil Sutter) [RHEL-190549]
  - doc: nft.8: Fix markup in ct expectation synopsis (Phil Sutter) [RHEL-190549]
  - mergesort: Avoid accidental set element reordering (Phil Sutter) [RHEL-190549]
  - doc: nft.8: Two minor synopsis fixups (Phil Sutter) [RHEL-190549]
  - tests: shell: check for reset tcp options support (Phil Sutter) [RHEL-190549]
  - tests: shell: payload matching requires egress support (Phil Sutter) [RHEL-190549]
  - tests: py: complete icmp and icmpv6 update (Phil Sutter) [RHEL-190549]
  - src: disentangle ICMP code types (Phil Sutter) [RHEL-190549]
  - evaluate: display "Range negative size" error (Phil Sutter) [RHEL-190549]
  - netlink_delinearize: restore binop syntax when listing ruleset for flags (Phil Sutter) [RHEL-190549]
  - doc: libnftables-json: Drop invalid ops from match expression (Phil Sutter) [RHEL-190549]
  - parser: json: Support for synproxy objects (Phil Sutter) [RHEL-190549]
  - tests: py: add payload merging test cases (Phil Sutter) [RHEL-190549]
  - nftables: do mot merge payloads on negation (Phil Sutter) [RHEL-190549]
  - rule: fix ASAN errors in chain priority to textual names (Phil Sutter) [RHEL-190549]
  - parser: compact type/typeof set rules (Phil Sutter) [RHEL-190549]
  - parser: compact interval typeof rules (Phil Sutter) [RHEL-190549]
  - src: improve error reporting for destroy command (Phil Sutter) [RHEL-190549]
  - tests: shell: permit use of host-endian constant values in set lookup keys (Phil Sutter) [RHEL-190549]
  - evaluate: permit use of host-endian constant values in set lookup keys (Phil Sutter) [RHEL-190549]
  - expression: missing line in describe command with invalid expression (Phil Sutter) [RHEL-190549]
  - netlink_delinearize: move concat and value postprocessing to helpers (Phil Sutter) [RHEL-190549]
  - evaluate: skip byteorder conversion for selector smaller than 2 bytes (Phil Sutter) [RHEL-190549]
  - cache: Optimize caching for 'list tables' command (Phil Sutter) [RHEL-190549]
  - evaluate: fix check for unknown in cmd_op_to_name (Phil Sutter) [RHEL-190549]
  - evaluate: don't assert on net/transport header conflict (Phil Sutter) [RHEL-190549]
  - json: Support sets' auto-merge option (Phil Sutter) [RHEL-190549]
  - rule: fix sym refcount assertion (Phil Sutter) [RHEL-190549]
  - evaluate: error out when store needs more than one 128bit register of align fixup (Phil Sutter) [RHEL-190549]
  - evaluate: do not fetch next expression on runaway number of concatenation components (Phil Sutter) [RHEL-190549]
  - evaluate: skip anonymous set optimization for concatenations (Phil Sutter) [RHEL-190549]
  - evaluate: add missing range checks for dup,fwd and payload statements (Phil Sutter) [RHEL-190549]
  - doc: incorrect datatype description for icmpv6_type and icmpvx_code (Phil Sutter) [RHEL-190549]
  - tests: shell: prefer project nft to system-wide nft (Phil Sutter) [RHEL-190549]
  - parser_bison: ensure all timeout policy names are released (Phil Sutter) [RHEL-190549]
  - netlink: fix stack overflow due to erroneous rounding (Phil Sutter) [RHEL-190549]
  - parser_bison: error out on duplicated type/typeof/element keywords (Phil Sutter) [RHEL-190549]
  - tests: shell: add test to cover payload transport match and mangle (Phil Sutter) [RHEL-190549]
  - evaluate: fix stack overflow with huge priority string (Phil Sutter) [RHEL-190549]
  - src: reject large raw payload and concat expressions (Phil Sutter) [RHEL-190549]
  - evaluate: exthdr: statement arg must be not be a range (Phil Sutter) [RHEL-190549]
  - meta: fix tc classid parsing out-of-bounds access (Phil Sutter) [RHEL-190549]
  - parser_bison: close chain scope before chain release (Phil Sutter) [RHEL-190549]
  - evaluate: fix bogus assertion failure with boolean datatype (Phil Sutter) [RHEL-190549]
  - parser_bison: fix objref statement corruption (Phil Sutter) [RHEL-190549]
  - tests: py: missing json output in meta.t with vlan mapping (Phil Sutter) [RHEL-190549]
  - evaluate: reset statement length context before evaluating statement (Phil Sutter) [RHEL-190549]
  - parser: tcpopt: fix tcp option parsing with NUM + length field (Phil Sutter) [RHEL-190549]
  - evaluate: reject set definition with no key (Phil Sutter) [RHEL-190549]
  - monitor: add support for concatenated set ranges (Phil Sutter) [RHEL-190549]
  - evaluate: disable meta set with ranges (Phil Sutter) [RHEL-190549]
  - evaluate: prevent assert when evaluating very large shift values (Phil Sutter) [RHEL-190549]
  - evaluate: reject sets with no key (Phil Sutter) [RHEL-190549]
  - evaluate: clone unary expression datatype to deal with dynamic datatype (Phil Sutter) [RHEL-190549]
  - tests: shell: split nat inet tests (Phil Sutter) [RHEL-190549]
  - evaluate: bogus error when adding devices to flowtable (Phil Sutter) [RHEL-190549]
  - tests: shell: flush connlimit sets (Phil Sutter) [RHEL-190549]
  - tests: shell: adjust add-after-delete flowtable for older kernels (Phil Sutter) [RHEL-190549]
  - evaluate: fix rule replacement with anon sets (Phil Sutter) [RHEL-190549]
  - tests: shell: skip if kernel does not support flowtable counter (Phil Sutter) [RHEL-190549]
  - tests: shell: restore pipapo and chain binding coverage in standalone 30s-stress (Phil Sutter) [RHEL-190549]
  - json: fix use after free in table_flags_json() (Phil Sutter) [RHEL-190549]
  - src: expand create commands (Phil Sutter) [RHEL-190549]
  - tests: shell: split set NAT interval test (Phil Sutter) [RHEL-190549]
  - tests: shell: split merge nat optimization in two tests (Phil Sutter) [RHEL-190549]
  - netlink: fix buffer size for user data in netlink_delinearize_chain() (Phil Sutter) [RHEL-190549]
  - src: remove xfree() and use plain free() (Phil Sutter) [RHEL-190549]
  - src: add free_const() and use it instead of xfree() (Phil Sutter) [RHEL-190549]
  - evaluate: place byteorder conversion before rshift in payload expressions (Phil Sutter) [RHEL-190549]
  - evaluate: reset statement length context only for set mappings (Phil Sutter) [RHEL-190549]
  - meta: fix hour decoding when timezone offset is negative (Phil Sutter) [RHEL-190549]
  - tproxy: Drop artificial port printing restriction (Phil Sutter) [RHEL-190549]
  - tests/shell: fix mount command in "test-wrapper.sh" (Phil Sutter) [RHEL-190549]
  - parser_bison: fix length check for ifname in ifname_expr_alloc() (Phil Sutter) [RHEL-190549]
  - tests/shell: cover long interface name in "0042chain_variable_0" test (Phil Sutter) [RHEL-190549]
  - tests/shell: add missing "elem_opts_compat_0.nodump" file (Phil Sutter) [RHEL-190549]
  - parser_bison: Fix for broken compatibility with older dumps (Phil Sutter) [RHEL-190549]


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.1-6
changelog:
  - Install NetworkManager override for nbft interfaces
  - Rename reconnect NetworkManager hook to 99-nvme-nbft-connect.sh


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.6-0.3.rc3
changelog:
  - Apply upstream patch for upstream bug 221
    - Revert change for false CVE-2020-26159 issue
      https://github.com/kkos/oniguruma/issues/221


author: Than Ngo <than@redhat.com> - 3.23.0-1
changelog:
  - Resolves: RHEL-23671, ep11 token: support protected keys for extractable keys
  - Resolves: RHEL-23672, ep11 token support for FIPS 2021-session bound EP11 keys
  - Resolves: RHEL-23673, update to 3.23.0


author: Than Ngo <than@redhat.com> - 3.24.0-1
changelog:
  - Resolves: RHEL-50064, update to 3.24.0
  - Resolves: RHEL-50063, opencryptoki CCA Token support for x86_64 and ppc64le
  - Resolves: RHEL-50058, openCryptoki CCA token support of Dilithium
  - Resolves: RHEL-50056, openCryptoki cca token SHA3 support
  - Resolves: RHEL-50057, openCryptoki cca token RSA OAEP v2.1 support


author: Than Ngo <than@redhat.com> - 3.25.0-1
changelog:
  - Resolves: RHEL-73344, upgrade openCryptoki
  - Resolves: RHEL-90590, basic support of AES-GCM
  - Resolves: RHEL-72965, cca token support cipher keys
  - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens
  - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server
  - Resolves: RHEL-75762, ep11 token: import and export of secure key objects
  - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys
  - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3


author: Than Ngo <than@redhat.com> - 3.25.0-2
changelog:
  - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x
  - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock


author: Than Ngo <than@redhat.com> - 3.25.0-3
changelog:
  - Fix incorrect effective group id of pkcsslotd daemon
  - Fix covscan findings
    Resolves: RHEL-104602


author: Than Ngo <than@redhat.com> - 3.25.0-4
changelog:
  - Fix pkcsslotd fails to start in FIPS
  - Drop tier1 test as it mostly provides duplicate results
  - Enable ci test for FIPS mode
    Resolves: RHEL-109050


author: Than Ngo <than@redhat.com> - 3.26.0-1
changelog:
  - Resolves: RHEL-75139, ep11 token BLS support
  - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support
  - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support
  - Resolves: RHEL-100059, openCryptoki 3.26.0


author: Than Ngo <than@redhat.com> - 3.27.0-1
changelog:
  - Resolves: RHEL-136096, Update to 3.27.0
  - Resolves: RHEL-157524, openCryptoki soft token: support PKCS #11 V3.2 ML-DSA and ML-KEM
  - Resolves: RHEL-157679, openCryptoki CCA token: support PKCS #11 V3.2 ML-DSA
  - Resolves: RHEL-157806, openCryptoki EP11 token: support PKCS #11 V3.2 ML-DSA and ML-KEM
  - Resolves: RHEL-169485, openCryptoki: ep11_specific.c syslog warning even for identically configured control points
  - Resolves: RHEL-171563, Fix CVE-2026-40253


author: Simon Pichugin <spichugi@redhat.com> - 2.6.8-1
changelog:
  - Rebase to version 2.6.8 (RHEL-71053)
  - Avoid SSL context cleanup during library destruction (RHEL-56502)


author: Simon Pichugin <spichugi@redhat.com> - 2.6.2-1
changelog:
  - Update to new major release OpenLDAP 2.6.2
  - The client tools parameters '-h' and '-p' are officially deprecated,
    please, use '-H' parameter instead.
    Related: rhbz#2094159


author: Simon Pichugin <spichugi@redhat.com> - 2.6.6-2
changelog:
  - The client tools parameters '-h' and '-p' are still deprecated,
    but this release brings back the client tools options that
    were removed during the previous rebase.
    Resolves: RHEL-19384


author: Simon Pichugin <spichugi@redhat.com> - 2.6.6-3
changelog:
  - Use systemd-sysusers for ldap user and group
    Replace License with SPDX identifier
    Resolves: RHEL-5140


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-1
changelog:
  - Rebase to latest 0.23.0 release (#2100409)
  - Use separate OpenSSL context to work better from inside of OpenSSL providers


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-2
changelog:
  - Fix regression in handling OpenPGP cards
  - Fix CVE-2023-2977: buffer overrun in pkcs15init for cardos


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-3
changelog:
  - Fix file caching with different offsets (RHEL-4079)
  - Fix CVE-2023-40660: Potential PIN bypass
  - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
  - Fix CVE-2023-4535: Out-of-bounds read in MyEID driver handling encryption using symmetric keys
  - Fix CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5 padding


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-2
changelog:
  - Fix implicit destination path selection when source path ends with ".."
    Resolves: RHEL-119515
  - Canonicalize username when matching a user
    Resolves: RHEL-118372


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-3
changelog:
  - Enable support for DSA keys
    Resolves: RHEL-127624
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-133959
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-133960


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-5 + 0.10.4-8
changelog:
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: RHEL-155825
  - Fix incorrect claim about SSH_AUTH_SOCK in pam_ssh_agent_auth manual page
    Resolves: RHEL-122302


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-8
changelog:
  - Fix static analysis issues
    Resolves: RHEL-163366
  - Ssh should refuse connection when mlkem kex is specified in FIPS
    Resolves: RHEL-155161
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164754
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166251
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166235
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166203
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166219


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-9
changelog:
  - CVE-2026-55653: Fix double free in openssh DH-GEX client path during
    FIPS known-group validation that leads to client-side denial of service
    Resolves: RHEL-186440
  - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
    cleanup due to missing NULL terminator
    Resolves: RHEL-185835
  - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
    pre-binding
    Resolves: RHEL-185850


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-10
changelog:
  - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
    in unintended parent directories when scp performs remote-to-remote copy
    via the local host
    Resolves: RHEL-193176
  - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange
    Resolves: RHEL-193023


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-12
changelog:
  - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
    file location
    Resolves: RHEL-236326
  - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
    handling of forwarding and tunneling options
    Resolves: RHEL-236284


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-13
changelog:
  - CVE-2026-73283: Complete the fix of security bypass due to incorrect
    handling of forwarding and tunneling options
    Resolves: RHEL-245414
  - CVE-2026-73281: Fix misinteraction between agent locking and
    the session-bind@openssh.com extension
    Resolves: RHEL-245422
  - CVE-2026-73282: Fix information disclosure and data corruption
    via use-after-free in ssh client
    Resolves: RHEL-245420


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-45
changelog:
  - Fix missing error codes set and invalid error code checks in OpenSSH. It
    prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
    is on (CVE-2025-26465).
    Resolves: RHEL-78700


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-2
changelog:
  - OpenSSL ignores "rh-allow-sha1-signatures = yes" option on RHEL-9
    Resolves: RHEL-88910
  - PKCS#12 should not default to pbmac1 in FIPS mode in RHEL-9
    Resolves: RHEL-88912
  - Fix `openssl speed` running in FIPS mode
    Resolves: RHEL-89860
  - pkeyutl ecdsa signature with sha1 shouldn't work by default
    Resolves: RHEL-89861
  - Expose settable params for EVP_SKEY
    Resolves: RHEL-89862
  - Restore RHEL9-style indicators defines
    Resolves: RHEL-89859
  - Enable sslkeylog support
    Resolves: RHEL-90854


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-4
changelog:
  - Compact patches for better maintainability
    Related: RHEL-80854
  - Make hybrid MLKEM work with our FIPS provider (3.0.7)
    Resolves: RHEL-95239


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-2
changelog:
  - Move fips.so to a seprate subpackage
    Reverts FIPS self test for SLH-DSA
    Add Suggests to try to prefer the openssl-fips-provider package
    over the fips-provider-next package by default
    Revolves: RHEL-102408
    Related: RHEL-80854


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-3
changelog:
  - Add custom define to disable symbol versioning in downstream patched code
    Also add stricter Suggests for openssl-fips-provider
    Resolves: RHEL-104236
  - Fix Requires/Provider to fix default install of fips providers
    Resolves: RHEL-104856


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-4
changelog:
  - Make openssl speed test signatures without errors
    Resolves: RHEL-95502
  - Build tests in check and without LTO
    Resolves: RHEL-111633


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.5-1
changelog:
  - Rebase to OpenSSL 3.5.5
    Resolves: RHEL-136895
    Resolves: RHEL-142004
    Resolves: RHEL-142012
    Resolves: RHEL-142020
    Resolves: RHEL-142024
    Resolves: RHEL-142028
    Resolves: RHEL-142032
    Resolves: RHEL-142036
    Resolves: RHEL-142040
    Resolves: RHEL-142044
    Resolves: RHEL-142048
    Resolves: RHEL-142052
    Resolves: RHEL-142056


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.7-1
changelog:
  - Rebase to OpenSSL 3.5.7
    Resolves: RHEL-179700
    Resolves: RHEL-179695
    Resolves: RHEL-179692
    Resolves: RHEL-179687
    Resolves: RHEL-179677
    Resolves: RHEL-179660
    Resolves: RHEL-179634
    Resolves: RHEL-179555
    Resolves: RHEL-179551
    Resolves: RHEL-179548
    Resolves: RHEL-179543
    Resolves: RHEL-179540
    Resolves: RHEL-179284
    Resolves: RHEL-179275


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.7-3
changelog:
  - In FIPS mode when neither FIPS provider nor FIPS provider configuration is
    present, OpenSSL silently falls back to the default provider.
    Resolves: RHEL-239862


author: Jakub Jelen <jjelen@redhat.com> - 0.4.11-8
changelog:
  - Fix sending parameters for RSA-OAEP operations (#2063378)
  - Improve logging and fix selection of expired certificates (#2029834)


author: Leo Sandoval <lsandova@redhat.com> - 1.77-11
changelog:
  - 90fallback: include possible kernel parameters from grub's default file
  - common.sh: do not resolve symbolic link on mapped device filesystems
  - Resolves: #RHEL-44705


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2025.7-1
changelog:
  - Rebase to 2025.7
    Backport https://github.com/ostreedev/ostree/pull/3555
    Resolves: #RHEL-129049


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2026.1-1
changelog:
  - Rebase to 2026.1
    Release https://github.com/ostreedev/ostree/releases/tag/v2026.1
    Resolves: #RHEL-167078


author: Joseph Marrero Corchado <jmarrero@redhat.com> - 2026.3-1
changelog:
  - Rebase to 2026.3
    Release https://github.com/ostreedev/ostree/releases/tag/v2026.3
    Resolves: #RHEL-234366


author: Joseph Marrero Corchado <jmarrero@redhat.com> - 2026.4-1
changelog:
  - Rebase to 2026.4
    Release https://github.com/ostreedev/ostree/releases/tag/v2026.4
    Resolves: #RHEL-246612


author: Zoltan Fridrich <zfridric@redhat.com> - 0.25.2-1
changelog:
  - Update to new upstream release 0.25.2
    Resolves: RHEL-14834
  - Add IBM specific mechanisms and attributes
    Resolves: RHEL-10570


author: Zoltan Fridrich <zfridric@redhat.com> - 0.25.3-3
changelog:
  - Fix regression in trust where file creation fails for long cert labels
    Resolves: RHEL-58899
  - Fix usage message in p11-kit list-tokens command
    Resolves: RHEL-31810


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-16
changelog:
  - libpam: use close_range() to close file descriptors. Resolves: RHEL-5099
  - fix formatting of audit messages. Resolves: RHEL-5100


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-18
changelog:
  - libpam: use getlogin() from libc and not utmp. Resolves: RHEL-16727
  - pam_access: handle hostnames in access.conf. Resolves: RHEL-22300


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-19
changelog:
  - pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS
    situations. CVE-2024-22365. Resolves: RHEL-21244


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-22
changelog:
  - pam_unix: always run the helper to obtain shadow password file entries.
    CVE-2024-10041. Resolves: RHEL-62879
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-23631 and RHEL-39943


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-24
changelog:
  - pam_unix: sync expiry checks with shadow. Resolves: RHEL-70519
  - pam.conf: remove tallylog. Resolves: RHEL-15324


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-26
changelog:
  - pam_unix: sync expiry checks with shadow.
    Resolves: RHEL-70519, RHEL-95475, RHEL-96955 and RHEL-96973
  - pam.conf: remove tallylog. Resolves: RHEL-15324
  - pam_namespace: fix potential privilege escalation.
    Resolves: CVE-2025-6020 and RHEL-96727


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-29
changelog:
  - pam_access: support UID and GID in access.conf
    Resolves: RHEL-119868
  - pam_lastlog: fix file locking. Resolves: RHEL-118522


author: Brian C. Lane <bcl@redhat.com> - 3.4-4
changelog:
  - Fix issues that covscan classifies as important
    Resolves: rhbz#1938836
  - Work around a mkswap bug


author: Brian C. Lane <bcl@redhat.com> - 3.5-1
changelog:
  - Rebase to upstream release 3.5
  - Drop patches included in new upstream tar
  - Add upstream patches for new type command
  - Add upstream patch for swap flag on DASD
    Resolves: rhbz#1999333


author: Brian C. Lane <bcl@redhat.com> - 3.5-3
changelog:
  - tests: Add test for dvh with a bad checksum (bcl)
    Related: RHEL-73217
  - libparted: Fix dvh disklabel unhandled exception (bcl)
    Related: RHEL-73217
  - tests: Add test for SUN disklabel handling (bcl)
    Related: RHEL-73217
  - libparted: Fix sun disklabel unhandled exception (bcl)
    Resolves: RHEL-73217


author: Petr Pisar <ppisar@redhat.com> - 8.43-3
changelog:
  - Make erroroffset initializion in a POSIX wrapper thread-safe
    (upstream bug #2447)
  - Fix an integer overflow when parsing numbers after "(?C" (upstream bug #2463)
  - Fix shifting integer bits and a NULL pointer dereferce in pcretest tool
    (upstream bug #2380)


author: Petr Pisar <ppisar@redhat.com> - 10.36-4
changelog:
  - Fix a mismatch if \K was involved in a recursion
  - Restore single character repetition optimization in JIT (upstream bug #2698)


author: Lukas Javorsky <ljavorsk@redhat.com> - 10.37-1
changelog:
  - Rebase to the 10.37
  - libpcre2-posix.so.2* SONAME bump to libpcre2-posix.so.3*
  - Enable JIT for s390x arch
  - Patches upstreamed: Patch 1,2,3,4
  - Resolves: rhbz#1970765, BZ#1965025


author: Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
changelog:
  - Rebase to current version from Fedora (#2017828)
  - Use of upstrea polkit policy preventing unneeded prompts


author: Jindrich Novy <jnovy@redhat.com> - 5:5.6.1-0.1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6
    (https://github.com/containers/podman/commit/d46b857)
  - fixes "Work on RHEL 9.7 packaging"
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 5:5.6.0-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/56f1962)
  - fixes "Work on RHEL 9.7 packaging"
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 6:5.8.5-2
changelog:
  - Rebuild for golang-1.26.6 CVE fixes (CVE-2025-68121 CVE-2026-27145
    CVE-2026-33811 CVE-2026-33818 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859
    CVE-2026-56860 CVE-2026-56862)
  - Resolves: RHEL-164485 RHEL-173976 RHEL-186006 RHEL-190092 RHEL-190858
    RHEL-212537 RHEL-241180 RHEL-241284 RHEL-241400 RHEL-241610 RHEL-241788


author: Petr Lautrbach <lautrbach@redhat.com> - 3.6-5
changelog:
  - sandbox/seunshare: Replace system() with execv() to prevent shell injection
  - seunshare: fix the frail tmpdir cleanup


author: Petr Lautrbach <lautrbach@redhat.com> - 3.6-9
changelog:
  - Several sandbox and seunshare security improvements
  - https://github.com/SELinuxProject/selinux/security/advisories/GHSA-h4m3-rc99-c7m5


author: Jan Rybar <jrybar@redhat.com> - 0.117-13
changelog:
  - session-monitor: watch sessions only
  - PolkitPermission: react on really changed sessions
  - allow polkit-pkla-compat to be uninstalled if no .pkla rules
  - Resolves: RHEL-39063


author: Than Ngo <than@redhat.com> - 1.3.10-1
changelog:
  - Resolves: #1920964, P10 Power Mode Reporting
  - Resolves: #2050893, Linux Hybrid Network Virtualizatio
  - Resolves: #2065169, bootloader fails to update boot order after OS install
  - Resolves: #2071862, Fix NM HNV setting primary slave
  - Resolves: #2089106, smtstate --save command failed


author: Than Ngo <than@redhat.com> - 1.3.10-3
changelog:
  - Resolves: #2111991, Add udev rule for the nx-gzip in to the core subpackage
  - Resolves: #2121470, Fix lsslot -c mem output when using 4GB LMB size
  - Resolves: #2110129, Add NVMf-FC boot support for Power


author: Than Ngo <than@redhat.com> - 1.3.10-4
changelog:
  - Resolves: #2150698, handle nsid of nvmf device as hexadecimal number
  - Resolves: #2150697, setup multiple device path for a nvmf boot device


author: Than Ngo <than@redhat.com> - 1.3.10-6
changelog:
  - Resolves: #2166870, lparstat: Fix display of mode for dedicated-donating partition
  - Resolves: #2169269, lparstat: Fix negative values seen while running lparstat with -E option


author: Than Ngo <than@redhat.com> - 1.3.10-7
changelog:
  - Fix negative values seen while running lpar
  - Fix lparstat error with mixed SMT state
  Resolves: #2225371


author: Than Ngo <than@redhat.com> - 1.3.10-8
changelog:
  - Resolves: RHEL-16045, Support partial SMT level through SYS FS smt/control files
  - Resolves: RHEL-11456, LPM hooks


author: Than Ngo <than@redhat.com> - 1.3.10-9
changelog:
  - Resolves: RHEL-20350, getting larger Negative value while running rtas_dbg -l
  - Resolves: RHEL-19076, installation fails if nsid of nvme device is greater than 10
  - Resolves: RHEL-11456, add new /etc/drmgr.d/pmig hierarchy


author: Than Ngo <than@redhat.com> - 1.3.10-11
changelog:
  - Resolves: RHEL-23620, nvram help page and man page are not in sync
  - Resolves: RHEL-23619, segault when running nvram --nvram-size 268435456
  - Resolves: RHEL-23624, segault when running nvram --print-config


author: Than Ngo <than@redhat.com> - 1.3.13-1
changelog:
  - Resolves: RHEL-30880, multipath - drmgr support
  - Resolces: RHEL-61089, lparstat -E Fails to Display Correct Values for %Busy and %Idle States


author: Than Ngo <than@redhat.com> - 1.3.13-2
changelog:
  - Resolves: RHEL-80729, drmgr: return correct value
  - Resolves: RHEL-80277, lparstat: print memory mode correctly


author: Than Ngo <than@redhat.com> - 1.3.13-3
changelog:
  - Resolves: RHEL-184814, Dynamically removing cores from an LPAR is not taking care of NUMA topology
  - Resolves: RHEL-180740, DLPAR Memory remove/add operations fail with SAP HANA DB loaded
  - Resolves: RHEL-212027, Continuous migration failure error messages observed while running memhotplug


author: Than Ngo <than@redhat.com> - 2.7.9-5
changelog:
  - man and help of diag_nvme are not in sync
  - compiler warnings
  - diag_nvme: call_home command fails on nvmf drive
  - rtas_errd: Fix core dump with large filename passed to -f option
  Resolves: RHEL-55398


author: Jan Rybar <jrybar@redhat.com> - 3.3.17-6
changelog:
  - free: backport new 'used' calculation
  - sysctl: backport support of systemd glob patterns
  - Resolves: rhbz#2003033
  - Resolves: rhbz#2052536


author: Jan Rybar <jrybar@redhat.com> - 3.3.17-7
changelog:
  - sysctl: backport - keys with dots instead of slashes again
  - Resolves: rhbz#2116977
  - Related: rhbz#2052536


author: Miro Hrončok <mhroncok@redhat.com> - 21.0.1-2
changelog:
  - python-pip-wheel: Remove bundled provides and libcrypt recommends for Python 2
    (The wheel is Python 3 only for a while)


author: Tomas Orsava <torsava@redhat.com> - 21.0.1-5
changelog:
  - Provide the platform-python-pip name for backwards compatibility
    with RHEL 8
  - Related: rhbz#1891487


author: Miro Hrončok <mhroncok@redhat.com> - 51.1.1-1
changelog:
  - Update to 51.1.1
  - Fixes test failures with pip 20.3 as well as with pytest 6.2+
  - Fixes: rhbz#1909575


author: Miro Hrončok <mhroncok@redhat.com> - 51.1.2-1
changelog:
  - Update to 51.1.2
  - Removes tests from the wheel
  - https://setuptools.readthedocs.io/en/latest/history.html#v51-1-2
  - Fixes: rhbz#1914481


author: Miro Hrončok <mhroncok@redhat.com> - 53.0.0-1
changelog:
  - Update to 53.0.0
  - https://setuptools.readthedocs.io/en/latest/history.html#v53-0-0
  - Fixes: rhbz#1923249


author: Tomas Orsava <torsava@redhat.com> - 53.0.0-5
changelog:
  - Provide the platform-python-setuptools name for backwards compatibility
    with RHEL 8
  - Related: rhbz#1891487


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-4
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143117
  Resolves: RHEL-143174
  Resolves: RHEL-144897


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-5
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143117, RHEL-143174, RHEL-144897


author: Miro Hrončok <mhroncok@redhat.com> - 3.9.25-8
changelog:
  - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+
  Resolves: RHEL-191730


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.23-1
changelog:
  - Update to 3.9.23
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98051, RHEL-98024, RHEL-98242, RHEL-98193, RHEL-98218


author: Tomas Orsava <torsava@redhat.com> - 1.14.5-5
changelog:
  - Add automatically generated Obsoletes tag with the python39- prefix
    for smoother upgrade from RHEL8
  - Related: rhbz#1990421


author: Miro Hrončok <mhroncok@redhat.com> - 3.0.4-14
changelog:
  - Subpackage python2-chardet has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Christian Heimes <cheimes@redhat.com> - 3.4.7-1
changelog:
  - Update to 3.4.7
  - Remove dependency on python-cryptography-vectors package and use vectors
    directly from Github source tar ball. Related: rhbz#1952343


author: Christian Heimes <cheimes@redhat.com> - 36.0.1-6
changelog:
  - Rebase to 36.0.1, related: rhbz#2059630, rhbz#2060787
  - OpenSSL 3.0 FIPS mode is now detected correctly, related: rhbz#2054785
  - Fix error check from EVP_PKEY_CTX_set_signature_md, related: rhbz#2060343
  - Block 3DES in FIPS mode, related: rhbz#2055209
  - Disable DSA tests in FIPS mode
  - Enable SHA1 signatures in test suite
  - Fix serialization of keyusage ext with no bits
  - Re-enable tests that are passing again


author: Christian Heimes <cheimes@redhat.com> - 36.0.1-3
changelog:
  - Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects, resolves rhbz#2172399
  - Fix FTBFS due to failing test_load_invalid_ec_key_from_pem and test_decrypt_invalid_decrypt


author: Miro Hrončok <mhroncok@redhat.com> - 1:2.8.0-7
changelog:
  - Subpackage python2-dateutil has been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: Miro Hrončok <mhroncok@redhat.com> - 1.2.8-9
changelog:
  - Subpackage python2-dbus has been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: Miro Hrončok <mhroncok@redhat.com> - 4.4.0-5
changelog:
  - Subpackage python2-decorator has been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-2
changelog:
  - Fix Python configuration for ELN/RHEL 9
  - Rework bconds for Python now that there are no Fedoras left that should
    use Python2


author: Christian Heimes <cheimes@redhat.com> - 2.1.0-3
changelog:
  - Add bconds for extras require trio, curio, and doh
  - Move trio and curio backend modules into extras subpackages
  - Enable python3-dns+curio meta package
  - Skip failing test testCanonicalNameDangling


author: Rafael Jeffman <rjeffman@redhat.com> - 2.2.1-1
changelog:
  - Rebase to version 2.2.1
    Resolves: rhbz#2088661
  - Disable DNSSEC tests using SHA1 due to crypto policies
    Resolves: rhbz#2107651


author: Tomas Popela <tpopela@redhat.com> - 3.40.1-6
changelog:
  - Fix the multilib problems by backporting fixes done by mhroncok from Fedora:
  - Move pure Python modules to a noarch subpackage
  - Ensure Python bytecode installed in multilib packages is bit-to-bit identical
    Resolves: rhbz#1915764


author: Miro Hrončok <mhroncok@redhat.com> - 2.8-5
changelog:
  - Subpackage python2-idna has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Miro Hrončok <mhroncok@redhat.com> - 0.4-39
changelog:
  - Subpackage python2-iniparse has been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: Miro Hrončok <mhroncok@redhat.com> - 0.9.6-19
changelog:
  - Subpackages python2-inotify, python2-inotify-examples have been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: John Kacur <jkacur@redhat.com> - 0.6.3-5
changelog:
  - various clean-ups including using 'with' context managers in try-except
  - Fix to ignore UnicodeDecodeError when it occurs
  Resolves: rhbz#2031717


author: John Kacur <jkacur@redhat.com> - 0.7.3-1
changelog:
  - Rebase to upstream python-linux-procfs-0.7.3
  - This rebase removes upstream spec files and
  - syncs the git tag with version
  Resolves: RHEL-7614


author: John Kacur <jkacur@redhat.com> - 0.7.4-2
changelog:
  - Update setup.py for older distributions
  - Use explicit setup.py build commands
  Resolves: RHEL-119895


author: Thomas Moschny <thomas.moschny@gmx.de> - 3.3.4-2
changelog:
  - Apply PR6 by Igor Raits <ignatenkobrain@fedoraproject.org>: Support
    for building on EPEL8 + upstream tests invocation.
  - Remove unused BR on python3-tidy (we'd need pytidylib instead, which
    doesn't seem to be packaged).


author: Dan Radez <dradez@redhat.com> - 4.8.0-6
changelog:
  - adding workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1914843
  - while we wait for upstream fix: https://github.com/pexpect/pexpect/issues/669


author: Tomas Orsava <torsava@redhat.com> - 21.2.3-4
changelog:
  - Make the python-pip-wheel subpackage versioned (python3-pip-wheel),
    and move its contents to a versioned directory /usr/share/python3-wheels
  - Resolves: rhbz#1982668


author: Tomas Orsava <torsava@redhat.com> - 21.2.3-5
changelog:
  - Conflict with old Python versions that use the old unversioned wheel location
  - Resolves: rhbz#1982668


author: Miro Hrončok <mhroncok@redhat.com> - 21.3.1-2
changelog:
  - Bump epoch for the virtual pip Provide, for this package to take precedence over python3.14-pip
  Resolves: RHEL-178095


author: Miro Hrončok <mhroncok@redhat.com> - 0.6.0-8
changelog:
  - Subpackage python2-ptyprocess has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Miro Hrončok <mhroncok@redhat.com> - 1.7.1-3
changelog:
  - Subpackage python2-pysocks has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Miro Hrončok <mhroncok@redhat.com> - 5.4.1-6
changelog:
  - Remove some outdated Obsoletes and Provides,
    but keep providing python3-yaml and python3-PyYAML for users
  - Related: rhbz#1990421


author: Florian Festi <ffesti@redhat.com> - 4.16.1.3-27
changelog:
  - Fix short circuiting of version strings in expressions (RHEL-15688)
  - Fix description of whatconflicts in the man page (RHEL-6303)
  - Expose and document rpmdb --verifydb operation (RHEL-14591)
  - Fixes to the file handling backport


author: Florian Festi <ffesti@redhat.com> - 4.16.1.3-29
changelog:
  - Actually add --verifydb to the man page (RHEL-14591)
  - Don't warn about missing user/group on skipped files (RHEL-18037)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-30
changelog:
  - Don't segfault on missing priority tag (RHEL-35249)
  - Use unsigned integers for buildtime too for Y2K38 safety (RHEL-22602)
  - Rebuild against libimaevm.so.4 (RHEL-32505)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-31
changelog:
  - Fix potential use of uninitialized pipe array (RHEL-22604)
  - Fix potential use of uninitialized pgp struct (RHEL-22605)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)
  - Add SourceLicense tag to spec syntax (RHEL-28798)
  - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-33
changelog:
  - Fix root relocation regression (RHEL-28967)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-35
changelog:
  - Fix %patch N applying Patch0 implicitly (RHEL-6294)
  - Issue deprecation warning for number-less %patch (RHEL-6294)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-37
changelog:
  - Allow parametric macros to opt out of option processing (RHEL-67161)
  - Report unsafe symlinks during installation as a specific case (RHEL-33393)
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-38
changelog:
  - Add support for spec local file attributes and generators (RHEL-52772)
  - Store configurable digest(s) on packages in rpmdb (RHEL-35619)
  - Fix a hard link race condition in brp-strip (RHEL-74011)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-40
changelog:
  - Improve error handling on keystore load (RHEL-114837)
  - Sort files before passing to file attr dependency generators (RHEL-95376)


author: Petr Lautrbach <plautrba@redhat.com> - 4.4.0-0.1.20201102git05e90ee
changelog:
  - Update to 05e90ee
  - Add /usr/bin/sechecker
  - Adapt to new libsepol filename transition structures
  - Rebuild with libsepol.so.2


author: Petr Lautrbach <lautrbach@redhat.com> - 4.4.3-1
changelog:
  - SETools 4.4.3 release
  - Improve man pages
  - seinfoflow: Add -r option to get flows into the source type.
  - seinfoflow.1: Remove references to sepolgen permission map.
  - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy.
  - SELinuxPolicy: Add explicit cast for libspol message


author: Tomas Orsava <torsava@redhat.com> - 53.0.0-7
changelog:
  - Make the python-setuptools-wheel subpackage versioned (python3-setuptools-wheel),
    and move its contents to a versioned directory /usr/share/python3-wheels
  - Resolves: rhbz#1982668


author: Miro Hrončok <mhroncok@redhat.com> - 234-11
changelog:
  - Subpackage python2-systemd has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 1.26.5-6
changelog:
  - Security fix for CVE-2024-37891
  - Backport upstream patch to fix TypeError for http connection if the PoolManager
  - is instantiated with server_hostname
  Resolves: RHEL-43172
  Resolves: RHEL-39285


author: Miro Hrončok <mhroncok@redhat.com> - 1.26.5-7
changelog:
  - Security fix for CVE-2025-66471
  - Security fix for CVE-2025-66418
  - Security fix for CVE-2026-21441
  Resolves: RHEL-142750, RHEL-139398, RHEL-142767


author: Petr Pisar <ppisar@redhat.com> - 1:4.05-17
changelog:
  - Support grace period expirations past 2038 year for XFS
  - Add a synopsis for a project quota option in the quota tool
  - Add a --filesystem option to the quota tool
  - Complain that ext4 external quota files are deprecated


author: Petr Pisar <ppisar@redhat.com> - 1:4.06-2
changelog:
  - Remove a dead code from process_file() (upstream bug #54)
  - Fix a compilation warning in quotaops.c
  - Warn when kernel XFS large time stamp does fit into (32-bit) user-space
    time_t
  - Do not use a pointless compiler-internal __P() macro


author: Pavel Reichl <preichl@redhat.com> - 1:4.09-1
changelog:
  - Update to new upstream version
  - Add tmpfs quota support
  - Remove rhel-only patches that were merged upstream


author: Sumit Bose <sbose@redhat.com> - 0.17.0-8
changelog:
  - LDAP socket timeout, fix duplicated logs and new Samba command line options
    Resolves: rhbz#2038260
    Resolves: rhbz#2038268
    Resolves: rhbz#2028530


author: Sumit Bose <sbose@redhat.com>
changelog:
  - Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - migrated to SPDX license
  - allow multiple names and _srv_ ad_server option
    Resolves: jira#RHEL-12112
  - fix ccache handling for leave operation
    Resolves: jira#RHEL-5104


author: Fedora Release Engineering <releng@fedoraproject.org> - 1:0.4-0.44.b46
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
  - Use standard make_build and make_install macros in spec file.


author: Jeff Makey <jeff@makey.net> - 1:0.4-0.46.b47
changelog:
  - New upstream release 0.4b47
  - Update main URL.
  - Drop dump-glibc_xattr patch, now applied upstream.
  - Drop documentation conversion from ISO-8859-1 to UTF-8, now applied upstream.
  - Print correct name of archive table of contents file (#1727392).


author: Josef Ridky <jridky@redhat.com> - 1:0.4-0.51.b47
changelog:
  - rename spec file to restore
  - add gating.yaml
  - changes between .47 and .51 had to be stripped due of wrong sync
    between centos and dist-git


author: systemd maintenance team <systemd-maint@redhat.com> - 252-61
changelog:
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215)
  - strv: introduce string_strv_hashmap_remove() (RHEL-14112)
  - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112)
  - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112)
  - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-62
changelog:
  - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558)
  - timer: rebase last_trigger timestamp if needed (RHEL-118215)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-63
changelog:
  - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859)
  - cryptsetup-generator: continue parsing after error (RHEL-127859)
  - cryptsetup-generator: parse all cmdline devices too (RHEL-127859)
  - cryptsetup-generator: always process cmdline devices (RHEL-127859)
  - logind: add "background-light" session class (RHEL-109833)
  - pam_systemd: honor session class provided via PAM environment (RHEL-109833)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-64
changelog:
  - core: fix array size in unit_log_resources() (RHEL-131338)
  - pid1: add env var to override default mount rate limit burst (RHEL-129153)
  - pid1: add env var to override default mount rate limit interval (RHEL-129153)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-65
changelog:
  - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-66
changelog:
  - core/service: fix error cause in the log (RHEL-138414)
  - fstab-generator: drop assertions for mount opts (RHEL-92752)
  - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752)
  - core: reorder systemd arguments on reexec (RHEL-111135)
  - basic: add RuntimeScope enum (RHEL-137252)
  - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252)
  - sd-path: add support for XDG_STATE_HOME (RHEL-137252)
  - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252)
  - path tool: add some basic ansi highlighing (RHEL-137252)
  - execude: include RuntimeScope field in ExecParameters (RHEL-137252)
  - execute: remove redundant assignment (RHEL-137252)
  - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252)
  - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252)
  - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252)
  - execute: shorten some code by using RET_NERRNO() (RHEL-137252)
  - execute: shorten code by making use of laccess() return code properly (RHEL-137252)
  - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252)
  - test: add test for new XDG_STATE_HOME handling (RHEL-137252)
  - man: mention the newly-added XDG_STATE_HOME (RHEL-137252)
  - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252)
  - man: properly close XML tags (RHEL-137252)
  - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252)
  - test: use XDG_STATE_HOME for %S and %L (RHEL-137252)
  - man: fully adopt ~/.local/state/ (RHEL-137252)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-68
changelog:
  - integritysetup: Add support for hmac-sha512 (RHEL-50213)
  - integritysetup: Add PHMAC algorithm to list of known algorithms (RHEL-50213)
  - manager: fix scope for environment generators (RHEL-159230)
  - core: validate input cgroup path more prudently (RHEL-155393)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-69
changelog:
  - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163871)
  - nspawn: normalize pivot_root paths (RHEL-163871)
  - core/service: do not propagate reload for combined RELOADING=1 + READY=1 when notify-reload (RHEL-108575)
  - udev: check for invalid chars in various fields received from the kernel (RHEL-163877)
  - udev: fix review mixup (RHEL-163877)
  - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163877)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-70
changelog:
  - core: cleanup unit's dropin directories from global cache (RHEL-127425)
  - udev: allow persistent storage rules for rbd devices (RHEL-3631)
  - udev/net_id: introduce naming scheme for RHEL-9.9 (RHEL-25518)
  - fstab-generator: support swap on network block devices (RHEL-166187)
  - core: increment start limit counter only when we can start the unit (RHEL-164539)
  - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-164539)
  - test: extend start limit interval (RHEL-164539)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-72
changelog:
  - man: reword the description of "secure pager" handling (RHEL-102941)
  - pager: also check for $SUDO_UID (RHEL-102941)
  - hwdb: make three more hwdb files parsed by parse_hwdb.py (RHEL-180937)
  - nss-systemd: avoid ELF TLS for recursion guard (RHEL-193714)
  - udev-builtin-net-id: print cescaped bad attributes (RHEL-180934)
  - udev: drop redundant checks (RHEL-180934)
  - Revert "udev-builtin-net-id: print cescaped bad attributes" (RHEL-180934)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-73
changelog:
  - hwdb,rules: add 82-net-auto-link-local.{hwdb,rules} to build (RHEL-180938)
  - test: reenable test for cg_get_keyed_attribute() (RHEL-180940)
  - Revert "hwdb: fix arrow keys on HP Elite Dragonfly G3" (RHEL-180939)
  - ci: bump the mkosi job to Ubuntu Noble (RHEL-155457)
  - ci: bump super-linter to v8.7.0 (RHEL-155457)
  - ci: explicitly disable multi status for Super-Linter (RHEL-155457)
  - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-155457)
  - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-155457)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-76
changelog:
  - resolved: replace assert() with error return in DNSSEC verify functions (RHEL-208860)
  - pid1: introduce new SERVICE_{DEAD|FAILED}_BEFORE_AUTO_RESTART service substates (RHEL-137251)
  - service: add new RestartMode option (RHEL-137251)
  - core/service: drop unneeded unit_add_to_gc_queue() (RHEL-137251)
  - core: get rid of unused Service.will_auto_restart logic (RHEL-118224)
  - core: drop UnitNotifyFlags (RHEL-118224)
  - core: split out the helper to serialize/deserialize ratelimits (RHEL-213655)
  - core: make manager event loop rate limit configurable (RHEL-213655)
  - iovec-util: add some useful helpers for dealing with iovecs that refer to dynamic memory (RHEL-212610)
  - repart: use iovec structure for --key-file (RHEL-212610)
  - repart: make --tpm2-pcrs also configurable in repart.d/* (RHEL-212610)
  - repart: make --key-file also configurable in repart.d/* (RHEL-212610)
  - man/repart: fix typo (RHEL-212610)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-77
changelog:
  - test: include util.sh needed for assert_*() functions (RHEL-155457)
  - test: drop forgotten `set +e` (RHEL-155457)
  - journal: treble field hash table size (RHEL-105520)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-78
changelog:
  - test: rename the start limit subtest (RHEL-164539)
  - ci: install GPG keys for Fedora 42 (RHEL-155457)


author: Jiri Hnidek <jhnidek@redhat.com> 8-1
changelog:
  - Translated using Weblate (Italian) (info@salvatorecocuzza.it)
  - Translated using Weblate (Chinese (Traditional) (zh_TW)) (noreply-mt-weblate-
    translation-memory@weblate.org)
  - Translated using Weblate (Spanish) (fserrador@gmail.com)
  - Translated using Weblate (Chinese (Traditional) (zh_TW)) (chzang55@gmail.com)
  - Translated using Weblate (Finnish) (ricky.tigg@gmail.com)
  - Various fixes in state management (tomatus777@gmail.com)
  - Upgrade to Patternfly 6 (tomatus777@gmail.com)
  - make eslint happy (tomatus777@gmail.com)
  - test: mock-insights should have /host_exists endpoint (pkoprda@redhat.com)
  - build: switch to esbuild (tomatus777@gmail.com)
  - build: fix installation of sub-man with newer Fedora (ptoscano@redhat.com)
  - refactor: Remove system purpose status (pkoprda@redhat.com)
  - refactor: Display status consistent with subscription-manager
    (pkoprda@redhat.com)
  - refactor: Simplify displaying of installed products (pkoprda@redhat.com)
  - Stop using deprecated translatable for html (jvanderwaa@redhat.com)


author: mhorky <mhorky@redhat.com> 9-1
changelog:
  - remove src/po.js (tomatus777@tomatus.cz)
  - translate placeholder strings (tomatus777@tomatus.cz)
  - index.html: fix import order and make localization work again (tomatus777@tomatus.cz)
  - Fixes: RHEL-111937


author: Packit <hello@packit.dev> - 14-1
changelog:
  - Convert license headers to SPDX format
  - Bug fixes and translation updates


  - Resolves: rhbz#2376500


author: Jiri Hnidek <jhnidek@redhat.com> 4-1
changelog:
  * Tue Jul 26 2022 Jiri Hnidek <jhnidek@redhat.com> 3-1
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - test: drop unused reference-image file (ptoscano@redhat.com)
  - Drop the static npm-shrinkwrap.json (ptoscano@redhat.com)
  - Bump cockpit test API to 273 + run-tests scheduler fix (martin@piware.de)
  - spec: suggest insights-client on RHEL (ptoscano@redhat.com)
  - tito: remove autogenerated spec file before tagging (ptoscano@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 5-1
changelog:
  - Translated using Weblate (French) (vincent.lefebvre59@gmail.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - 2077759: invoke cockpit.translate() after document loading
    (ptoscano@redhat.com)
  - test: Drop outdated copy of packagelib.py (martin@piware.de)
  - Added missing keys to react components (jhnidek@redhat.com)
  - Fix the issue, when it is not possible to install insights-client
    (jhnidek@redhat.com)
  - test: Sync packagelib.py with cockpit main (martin@piware.de)
  - New target and added one project directory to .gitignore (jhnidek@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 6-1
changelog:
  - Translated using Weblate (Kannada) (jsefler@redhat.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - 2169976: insights: fix spawn_error_to_string in more cases
    (ptoscano@redhat.com)


author: Pavel Raiskup <praiskup@redhat.com> - 1.6-1
changelog:
  - new upstream release
  - drop WITH_SELINUX knob and selinux patches, there's built-in support now
  - drop several patches which were incorporated upstream, except for
    changewarnSegv patch (did not apply, and not needed nowadays)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-3
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm
    is not run in a container (bz 1965318)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-4.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190 (bz 1965318)
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Adjust Source0 to a more proper one


author: Vladis Dronov <vdronov@redhat.com> - 6.15-1
changelog:
  - Update to the upstream v6.15 @ 172bf0e3 (bz 2075977)
  - Allow rngd process to drop privileges with "-D user:group"
  - Fix an error building with jitterentropy-3.4.0
  - Add a requirement for selinux-policy of a certain version
  - Fix a build failure on ppc64
  - Small edits in test scripts


author: Vladis Dronov <vdronov@redhat.com> - 6.15-2
changelog:
  - Update to the upstream v6.15 + tip of origin/master @ 6dcc9ec2 (bz 2124605)
  - Do not require selinux-policy if it is not present


author: Vladis Dronov <vdronov@redhat.com> - 6.15-3
changelog:
  - Update to the upstream v6.15 + tip of origin/master @ cb8cc624 (bz 2156554)
  - Fix a number of issues found by covscan code scanner
  - Add a jitter init timeout for tests
  - Add a start condition for the FIPS mode (bz 2154804)


author: Vladis Dronov <vdronov@redhat.com> - 6.16-1
changelog:
  - Update to the upstream v6.16 + tip of origin/master @ 0e560296 (bz 2174916)
  - Get rid of text relocations in -fPIE build
  - Add a hint for opensc package (bz 1845854)


author: Vladis Dronov <vdronov@redhat.com> - 6.16-7
changelog:
  - Update to the upstream v6.16 + tip of origin/master @ 98cf8d63 (RHEL-30953)
  - Use proper SPDX license identifiers
  - Fix a test failure


author: Vladis Dronov <vdronov@redhat.com> - 6.17-1
changelog:
  - Add Intel CET IBT instrumentation to assembly code
  - Update to the upstream v6.17 @ ac43f912 (RHEL-64951)


author: Vladislav Dronov <vdronov@redhat.com> - 6.17-10
changelog:
  - Update to the upstream v6.17 @ e8da3cdc (RHEL-176340)
  - Handle new radiacode entropy source
  - Build with the updated jitterentropy v3.7.0 library
  - Drop the older i686 force-PIC fix


author: Till Maas <opensource@till.name> - 8.1-26
changelog:
  - Sync in current files from bash package:
    https://src.fedoraproject.org/rpms/bash/c/739b272e5f5d10cf27a847a44d09eb7f4b6ec89b?branch=master
    https://src.fedoraproject.org/rpms/bash/c/329df36f8bbc303be618f06562ec2c4eebfd1d29?branch=master
    https://src.fedoraproject.org/rpms/bash/c/e3b3cd9cec4a3bd12a792536c0ea131f5ba5bd72?branch=master


author: Steve Dickson <steved@redhat.com> - 1.2.6-1
changelog:
  - Use sysconfig variable in service file (bz 1972094)
  - Make sure policycoreutils is installed before using it (bz 1972133)
  - Make sure /var/lib/rpcbind exists (bz 1972133)
  - Corrected the URL reference (bz 1972117)


author: Steve Dickson <steved@redhat.com> - 1.2.6-4
changelog:
  - Use 
  %setup       -q




  /usr/bin/cat /builddir/build/SOURCES/rpcbind-1.2.6-double-free.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.3-systemd-envfile.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.3-systemd-tmpfiles.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.4-runstatdir.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-1.2.6-systemd-service.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.4-systemd-rundir.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2026.1-5
changelog:
  - Backport https://github.com/coreos/rpm-ostree/pull/5575
    Backport https://github.com/coreos/rpm-ostree/pull/5576
    Resolves: RHEL-154808


author: Michal Ruprich <mruprich@redhat.com> - 3.2.3-21
changelog:
  - Resolves: RHEL-70265 - Rebase rsync to 3.2.5
  - Resolves: RHEL-67142 - Wrong progress reported by rsync when using copy-devices
  - Resolves: RHEL-29340 - Slowness in rsync due to extra validation steps.
  - Resolves: RHEL-18216 - rysnc script /usr/share/doc/rsync/support/rrsync is unsecure


author: Michal Ruprich <mruprich@redhat.com> - 3.2.5-2
changelog:
  - Resolves: RHEL-70158 - Info Leak via Uninitialized Stack Contents
  - Resolves: RHEL-70208 - Path traversal vulnerability in rsync
  - Resolves: RHEL-70210 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-71657 - Race Condition in rsync Handling Symbolic Links


author: Michal Ruprich <mruprich@redhat.com> - 3.2.5-6
changelog:
  - Resolves: RHEL-169151 - CVE-2026-41035 - Use-after-free vulnerability in extended attribute handling


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-5
changelog:
  - resolves: RHEL-101761 - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.22.2-4.el9)


author: Andreas Schneider <asn@redhat.com> - 4.19.4-100
changelog:
  - related: RHEL-16476 - Update to version 4.19.4
  - resolves: RHEL-2109 - Add support for certificate auto enrollment
  - resolves: RHEL-20761 - Add missing requirements for samba-gpupdate
  - resolves: RHEL-19566 - Fix smbget interactive authentication
  - resolves: RHEL-21001 - Fix samba-gpupdate paths for RHEL


author: Andreas Schneider <asn@redhat.com> - 4.19.4-102
changelog:
  - resolves: RHEL-22157 - Don't require NDES for samba-gpupdate
  - resolves: RHEL-20897 - Fix site name fetching for samba-gpupdate


author: Pavel Filipenský <pfilipen@redhat.com> - 4.20.0-102
changelog:
  - resolves: RHEL-2109  - Support Certificate Auto Enrollment in Samba
  - resolves: RHEL-22157 - Fix root cert import for samba-gpupdate


author: Pavel Filipenský <pfilipen@redhat.com> - 4.20.1-1
changelog:
  - related: RHEL-33645 - Update to version 4.20.1
  - resolves: RHEL-26337 - Fix site lookup for samba-gpupdate
  - resolves: RHEL-5846 - Fix warning messages while upgrading libwbclient


author: Pavel Filipenský <pfilipen@redhat.com> - 4.20.2-1
changelog:
  - related: RHEL-33645 - Update to version 4.20.2
  - resolves: RHEL-45841 - Fix KDC IP address lookup in case of trusted domain
  - resolves: RHEL-23814 - Fix smbclient to enumerate the printers


author: Jakub Martisko <jamartis@redhat.com> - 4.8-10
changelog:
  - lib/dfa.c: Increase the maximum size of the transitions table
  - After changes introduced between sed 4.2 and 4.4, some regexps
    started to hit the table size limits. This lead to repeated deletion
    and rebuilding of the table, leading to massive performance drops.
    While the core issue is still present, this change should at least
    help by moving the threshold of the regexp complexity that triggers the 
    table rebuilds.
  - Resolves: RHEL-144026


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.74-1
changelog:
  - Label /run/insights-client.ppid with insights_client_run_t
  Resolves: RHEL-146688
  - Update gpg_role() interface with unix_stream_socket permissions
  Resolves: RHEL-128542


author: Veronika Syncakova <vsyncako@redhat.com> - 38.1.77-1
changelog:
  - Allow pkcsslotd map its private tmpfs files
  - Allow pkcsslotd read files in /proc and /sys
  Resolves: RHEL-155929
  - Allow dhcpc_hook_t unix_dgram_socket and module_request
  Resolves: RHEL-147155
  - Allow xdm dbus chat with rhsmcertd
  Resolves: RHEL-157008
  - Allow logwatch to getattr nsfs files
  Resolves: RHEL-160896
  - Allow systemd-tmpfiles to adjust resource limits
  Resolves: RHEL-163080
  - Dontaudit setroubleshootd read root's home files like .rpmmacros
  Resolves: RHEL-147470
  - Allow redis_t to create netlink_rdma_socket
  Resolves: RHEL-161115


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.78-1
changelog:
  - Allow dbus-broker to use inherited user ttys
  Resolves: RHEL-86925
  - Allow sysadm user connect to lvm over a unix stream socket
  Resolves: RHEL-150996


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.79-1
changelog:
  - Do not audit iptables attempts to read other process state
  Resolves: RHEL-152287
  - Allow iptables_t read state of some processes
  Resolves: RHEL-152287
  - Allow iptables read firewalld process state
  Resolves: RHEL-152287
  - Allow systemd-machined read virtd process state
  Resolves: RHEL-152287
  - Allow systemd-machined read svirt process state
  Resolves: RHEL-152287
  - Label /dev/HID-SENSOR-.* with hid_sensor_device_t
  Resolves: RHEL-166739


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.80-1
changelog:
  - Allow fido services connect to postgres database
  Resolves: RHEL-28814
  - Allow qatlib map kernel modules
  Resolves: RHEL-133799


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.81-1
changelog:
  - Add the systemd_logind_stream_connect() interface
  Resolves: RHEL-163438
  - Add files_mounton_generic_tmp_dirs() interface
  Resolves: RHEL-163438
  - Allow staff user mounton /var/lib dirs
  Resolves: RHEL-163438
  - Allow staff user read nsfs files
  Resolves: RHEL-163438
  - Allow staff user additional sandboxing permissions
  Resolves: RHEL-163438
  - Allow staff_sudo_t read PID1's process state
  Resolves: RHEL-163438
  - Allow staff_sudo_t read logind sessions files
  Resolves: RHEL-163438
  - Allow staff user delete thump_tmp_t files
  Resolves: RHEL-163438
  - Allow login_userdomain read thumb tmp files
  Resolves: RHEL-163438
  - Allow staff user connect to systemd-logind over a unix stream socket
  Resolves: RHEL-163438
  - Allow staff user mount /proc
  Resolves: RHEL-163438
  - Support confined users usage of bubblewrap
  Resolves: RHEL-163438
  - Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  Resolves: RHEL-179125
  - Allow rhsmcertd read anaconda run files
  Resolves: RHEL-179125
  - Allow any domain to inherit fds from rpm-ostree
  Resolves: RHEL-179125
  - Allow install_t domain transition to insights_client_t
  Resolves: RHEL-179125
  - Allow logrotate stop all systemd services
  Resolves: RHEL-169534
  - Allow staff and sysadm execute iotop using sudo
  Resolves: RHEL-172235
  - Allow sysadm_t to connect to iscsid using a unix domain stream socket
  Resolves: RHEL-155605


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.83-1
changelog:
  - Remove systemd_homed_stream_connect() reference for bootupd_t
  Resolves: RHEL-174888
  - Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  Resolves: RHEL-145322
  - Update bootupd policy for running lsblk
  Resolves: RHEL-174888
  - Allow aide get attributes of all filesystems
  Resolves: RHEL-182787
  - Allow the staff user mount on tmpfs directories
  Resolves: RHEL-183237
  - Allow staff user the dac_override capability in the user namespace
  Resolves: RHEL-183237
  - Allow userdomain get attributes of files on an nsfs filesystem
  Resolves: RHEL-163438


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.84-1
changelog:
  - Add 2 interfaces helping to handle cloud-what cache files
  Related: RHEL-179125
  - Allow local login and sshd-session signull cockpit-session
  Resolves: RHEL-107874
  - Allow sysadm_t read/write kvm devices
  Resolves: RHEL-107874
  - Allow staff_t and user_t execute udev without a domain transition
  Resolves: RHEL-130797
  - Allow bootupd read all passwd sources
  Resolves: RHEL-219156
  - Allow unconfined_t mounton its lnk_files
  Resolves: RHEL-214141
  - Allow sysadm user run fail2ban-client
  Resolves: RHEL-194366
  - Update files_search_base_file_types()
  Resolves: RHEL-182260
  - Update sysadm policy for encrypted volumes usage
  Resolves: RHEL-180921
  - Allow rhsmcertd read selinux config and default file contexts
  Resolves: RHEL-180764
  - Changes adapting to bind packages with suffixes
  Resolves: RHEL-192093


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.85-1
changelog:
  - Add the files_map_read_var_files() interface
  Resolves: RHEL-123612
  - Allow login_userdomain mount, remount, unmount all mount points
  Resolves: RHEL-123612
  - Allow login_userdomain mount on all mount points
  Resolves: RHEL-123612
  - rhsmcertd: allow bootc/ostree transient package persistence detection
  Resolves: RHEL-243228
  - Allow dhcpc hook query the chronyd service
  Resolves: RHEL-240725
  - Allow dhcpc_hook_t connect to init_t over a unix stream socket
  Resolves: RHEL-240725
  - Add aliases.lmdb to mta_filetrans_named_content()
  Resolves: RHEL-240445
  - Label /etc/aliases.lmdb with etc_aliases_t
  Resolves: RHEL-240445
  - Allow rhsmcertd read insights-client config files
  Resolves: RHEL-237969
  - Allow rhsmcertd read the file_contexts files
  Resolves: RHEL-236545
  - Allow namespace_init_t execute generic programs in bin directories
  Resolves: RHEL-223973
  - Make insights_client_t accessible from the system cronjob
  Resolves: RHEL-180832
  - Add the anaconda_read_state_install() interface
  Resolves: RHEL-179125
  - Allow insights-client read gconf home files
  Resolves: RHEL-176023
  - Allow rhsmcertd read gconf home files
  Resolves: RHEL-106483
  - Update policy for virsh_ssh_t to help with live migration
  Resolves: RHEL-60450


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.86-1
changelog:
  - Label malware-detection-config.yml with insights_client_etc_rw_t
  Resolves: RHEL-237969
  - Add the files_write_system_conf_files() interface
  Resolves: RHEL-237969
  - Allow rhsmcertd search gconf home data dirs
  Resolves: RHEL-106483
  - Allow rhsmcertd read gconf home files
  Resolves: RHEL-106483
  - Revert "Allow rhsmcertd read gconf home files"
  Resolves: RHEL-106483


author: Martin Osvald <mosvald@redhat.com> - 2.13.7-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2066753)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#2066767)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#2026892)


author: Martin Osvald <mosvald@redhat.com> - 2.13.6-1
changelog:
  - csh.login: set PATH again (if empty) to prevent interpreter error (#1744106)
  - aliases: add pcp user (#1744091)
  - lang.csh: fix several variable substitution bugs and typos (#1746749)
  - don't set LANG as a per-shell variable
  - fix lang.csh script so it doesn't break tcsh -e scripts II (#1620004)
  - use full path for non-builtins in csh.cshrc, csh.login, lang.csh, lang.sh and profile (#1747493)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.47-7
changelog:
  - Fix sg_inq parsing in rescan-scsi-bus.sh (#2036005,#2035362)
  - Fix rescan-scsi-bus.sh summary print (#2035382)
  - sg_readcap --zbc man page switch fix (#2036718)
  - Various Covscan fixes (#2044433)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
changelog:
  - useradd: check if subid range exists for user. Resolves: #2179987
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #2179988


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-13
changelog:
  - nss.c: shadow_logfd to stderr. Resolves: RHEL-83431
  - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-17
changelog:
  - subordinateio.c: list_owner_ranges(): Fix duplicate range when
    username matches ID. Resolves: RHEL-175708


author: Jindrich Novy <jnovy@redhat.com> - 2:1.22.2-2
changelog:
  - update to https://github.com/containers/skopeo/releases/tag/v1.22.2
  - re-add test file installation to fix tier0 tests
  - Resolves: RHEL-170602


author: Jindrich Novy <jnovy@redhat.com> - 3:1.22.2-1
changelog:
  - switch to sustaining-engineering GitLab release-1.22 branch and bump epoch to
    fix upgrade path
  - Resolves: RHEL-220456


author: Jindrich Novy <jnovy@redhat.com> - 3:1.22.2-4
changelog:
  - Rebuild for golang-1.26.6 CVE fixes (CVE-2025-68121 CVE-2026-33811
    CVE-2026-27145 CVE-2026-33818 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859
    CVE-2026-56860 CVE-2026-56862)
  - Resolves: RHEL-164492 RHEL-187324 RHEL-190003 RHEL-241116 RHEL-241304
    RHEL-241601 RHEL-241835 RHEL-242236


author: Jindrich Novy <jnovy@redhat.com> - 1.3.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.2
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1.3.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.3
  - Resolves: RHEL-94765


author: Jindrich Novy <jnovy@redhat.com> - 1.3.4-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.4
  - Resolves: RHEL-212436


author: Martin Gieseking <martin.gieseking@uos.de> - 1.1.8-1
changelog:
  - Updated to new release.
  - Dropped version-related patch which has been applied upstream (BZ #1527850).


author: Jan Jansky <jjansky@redhat.com> = 4.9.1-2
changelog:
  - Update to 4.9.1-2 in RHEL 9
    Resolves: RHEL-86668
    Resolves: RHEL-86644
    Resolves: RHEL-86647
    Resolves: RHEL-86646


author: Jan Jansky <jjansky@redhat.com> = 4.9.2-1
changelog:
  - Update to 4.9.2 
    Resolves: RHEL-101717
    Resolves: RHEL-101718
    Resolves: RHEL-101719
    Resolves: RHEL-101720


author: Jan Jansky <jjansky@redhat.com> = 4.10.0-1
changelog:
  - Update to 4.10.0
    Resolves: RHEL-110500
    Resolves: RHEL-110501
    Resolves: RHEL-110502
    Resolves: RHEL-110503


author: Abhi Das <adas@redhat.com> - 4.4-9.git1
changelog:
  - CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination
    rhbz#2000638


author: Abhi Das <adas@redhat.com> - 4.4-10.git1
changelog:
  - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix
    rhbz#2007304


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-3
changelog:
  - Address some issues reported by covscan (#1996691).
  - Replace 0141-tests-disable-sockopt-timestamp-on-new-glibc-with-__.patch
    with upstream v5.13-10-g0211fdc "tests: change sockopt-timestamp test
    to use syscall(__NR_recvmsg)"
    and 0154-tests-call-setsockopt-directly-in-sockopt-timestamp.patch.
  - Undo forceful injection of -m64 into CFLAGS/CPPFLAGS to avoid breaking
    mpers and its tests (#1996676).


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2
changelog:
  - Fix the issues reported by covscan (#2103068).
  - Fix SELinux context matching for the deleted paths (#2087693).
  - Fix sloppy FD usage in the bpf test (#2103137).
  - Cater for RHEL 9 license requirement idiosyncrasies (#2103032).


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-1
changelog:
  - Rebase to v6.7; drop upstream patches on top of 5.18 (RHEL-8646).
  - Updated the SPDX license expression.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-2
changelog:
  - Fix incorrect syscall name reporting in restart_syscall() on attach when
    PTRACE_GET_SYSCALL_INFO is in use (RHEL-65109).
  - Update net-yy-inet* and linkat--secontext_mismatch tests.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.12-1
changelog:
  - Rebase to v6.12; drop upstream patches on top of 6.7, drop the harcoded
    "-isystem /usr/include" from CPPFLAGS (RHEL-8646).


author: Sahana Prasad <sahana@redhat.com> - 5.57-1
changelog:
  - New upstream release 5.57
  - Fixes #1925229 - client certificate not correctly verified
    when redirect and verifyChain options are used


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 5.58-4
changelog:
  - Stunnel cannot use an encrypted private key being built against OpenSSL 3.0
  - Resolves: rhbz#1976854


author: Clemens Lang <cllang@redhat.com> - 5.62-2
changelog:
  - Fix stunnel in FIPS mode
    Resolves: rhbz#2050617
  - Fail build if tests fail
    Resolves: rhbz#2051083


author: Clemens Lang <cllang@redhat.com> - 5.71-1
changelog:
  - New upstream release 5.71
    Resolves: RHEL-2468
  - Enable socket activation support
  - verify upstream source in %prep
  - clean up stale conditionals


author: Clemens Lang <cllang@redhat.com> - 5.71-2
changelog:
  - Speed up loading client CA list from CAfile
    Resolves: RHEL-52321
  - Do not load all CAs in client mode to allow continued use of BEGIN TRUSTED CERTIFICATE format
    Resolves: RHEL-52317


author: William Poteat <wpoteat@redhat.com> 1.29.10-1
changelog:
  - Switch dates returned by D-Bus ListInstalledProducts to ISO 8601
    (ptoscano@redhat.com)
  - 1793501: switch dates returned by D-Bus GetPool to ISO 8601
    (ptoscano@redhat.com)
  - Add format_iso8601_date.format_iso8601_date() (ptoscano@redhat.com)
  - Make sure, re-register works for deb repos (suttner@atix.de)
  - 1863039: Fix issue with dnf/yum variables (jhnidek@redhat.com)
  - 1879856: suppress the warning message when setting syspurpose values
    (tmerry@redhat.com)
  - ENT-2779: call format() on translated string (ptoscano@redhat.com)
  - 1930037: cockpit: ensure /etc/pki/product exist (ptoscano@redhat.com)
  - 1886772: Clear content access mode cache on refresh (csnyder@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - Reword ambiguous message (ptoscano@redhat.com)
  - Properly use ungettext for plural forms (ptoscano@redhat.com)
  - cockpit: fix extraction of plural messages (ptoscano@redhat.com)
  - 1672805: 'Addons' is failing spell check and should be changed to 'Add-ons'
    to match documentation (tmerry@redhat.com)
  - 1731109: improve man page & help for registering with --force option
    (tmerry@redhat.com)
  - 1749395: Proper handling when a user does not have an org
    (wpoteat@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - 1916540: Negative proxy tests occasionally encounter the wrong exception
    handling (tmerry@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Korean) (suanand@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - ENT-3711: Fix a couple of typos (tmerry@redhat.com)
  - ENT-2468: Use format strings with named arguments for translator context
    (tmerry@redhat.com)
  - ENT-3276: refactor test_managercli.py by modules (ptoscano@redhat.com)
  - 1897767: what does 'No Valid values provided for usage' mean to the user
    (tmerry@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Replace optparse with argparse (wpoteat@redhat.com)
  - Fix variable for RestlibException exception (ptoscano@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Correction for condition that was breaking 3 nosetests (wpoteat@redhat.com)
  - maybe this time? (tmerry@localhost.localdomain)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Remove extra '%' in string (ptoscano@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - cockpit: Adjust for changed services image (martin@piware.de)
  - Update translation files (noreply@weblate.org)
  - New extraction for translatable strings (wpoteat@redhat.com)
  - Update translation files (noreply@weblate.org)
  - 1897767: what does 'No valid values provided for usage' mean to the user
    (tmerry@localhost.localdomain)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - 1856832: add --org=ORG to the ROLE OPTIONS, USAGE OPTIONS and ADDONS OPTIONS
    (tmerry@localhost.localdomain)
  - 1880920: check for invalid addons (ptoscano@redhat.com)
  - Add AbstractSyspurposeCommand._are_provided_values_valid helper
    (ptoscano@redhat.com)
  - 1924166: improve man text of syspurpose --show (ptoscano@redhat.com)
  - 1646718 debrand a message so that it doesn't say Red Hat Subscription Manager
    but instead an entitlement server (tmerry@localhost.localdomain)


author: William Poteat <wpoteat@redhat.com> 1.29.11-1
changelog:
  - Add subscription-manager dependency to apt-katello-transport (kolb@atix.de)
  - 1898552: refactor/fix collection of IP v4/v6 address info
    (ptoscano@redhat.com)
  - cockpit: Enable TLS for mock insights server (martin@piware.de)
  - adding timoeout to jenkins pipeline (#2585) (jmolet@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - 1819555: cockpit: translate untranslatable messages (ptoscano@redhat.com)
  - Replace hardcoded errno value with constant (ptoscano@redhat.com)
  - 1940658: bash: complete also the syspurpose subcommand (ptoscano@redhat.com)
  - 1878736: use our i18n functions instead of dnf ones (ptoscano@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.12-1
changelog:
  - 1953069: bash: fix listing of config options (#2609) (ptoscano@redhat.com)
  - Cleanup old *.egg-info dirs in %post (csnyder@redhat.com)
  - 1953047: bash: drop completion for subscribe & unsubscribe
    (ptoscano@redhat.com)
  - 1952228: fix formatting of log error messages (ptoscano@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.13-1
changelog:
  - Updated translations for Korean, Chinese (simiplified, zh_CN), Italian
  - Refactoring of cloud collector/detector and facts (#2515)
    (jhnidek@redhat.com)
  - 1920020: show error message when setting invalid default_log_level as well as
    on every run until changed to a valid value (tmerry@redhat.com)
  - 1959048: improve wording for missing or empty syspurpose values
    (ptoscano@redhat.com)
  - Update translation files (noreply@weblate.org)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - 1960765: fix typo "explicity" in man page (ptoscano@redhat.com)
  - cockpit: Lower cockpit-ws dependency to Recommends (martin@piware.de)
  - test: Robustify and trim down cockpit-ws installation (martin@piware.de)
  - jenkins: switch stylish job to Python 3 (ptoscano@redhat.com)
  - flake8: add more locally found issues (ptoscano@redhat.com)
  - Remove extra whitespace before '(' (ptoscano@redhat.com)
  - 1952879: extract messages from argparse instead of optparse
    (ptoscano@redhat.com)
  - po: set Project-Id-Version to rhsm (ptoscano@redhat.com)
  - po: fuzzy messages with invalid/missing placeholders (ptoscano@redhat.com)
  - po: ko: manually fix placeholder (ptoscano@redhat.com)
  - Update script reference to base branch to main (wpoteat@redhat.com)
  - 1896715: Set proper read permissions on certs (wpoteat@redhat.com)
  - cockpit: Use PF4 based empty state (mmarusak@redhat.com)
  - cockpit: Drop uglification (mmarusak@redhat.com)
  - cockpit: Use 'noreferrer' for external links (mmarusak@redhat.com)
  - cockpit: Add `standard-jsx` eslint plugin (mmarusak@redhat.com)
  - cockpit: Remove loaders for .es6 files (mmarusak@redhat.com)
  - cockpit: Add package-lock.json to .gitignore (mmarusak@redhat.com)
  - build: drop version requirements for pep8 and flake8 (ptoscano@redhat.com)
  - build: remove pyqver test requirement (ptoscano@redhat.com)
  - Add flake8 configuration (ptoscano@redhat.com)
  - Add missing second empty line after class/function (ptoscano@redhat.com)
  - Fix some over-indented code blocks (ptoscano@redhat.com)
  - jenkins: disambiguate virtualenv names (ptoscano@redhat.com)
  - 1956654: Fix issue with proxy and cockpit plugin (jhnidek@redhat.com)
  - Releaser for Centos (wpoteat@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.14-1
changelog:
  - Drop more files/references of old standalone syspurpose tool
    (ptoscano@redhat.com)
  - 1967780: improve placeholders in help text (ptoscano@redhat.com)
  - Update translation files (noreply@weblate.org)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - 1898563: move syspurpose subcommands within the 'syspurpose' command
    (ptoscano@redhat.com)
  - Rename internal variable for syspurpose --show (ptoscano@redhat.com)
  - Drop command name from args when parsing them (ptoscano@redhat.com)
  - 1941904: disable initial-setup in RHEL >= 9 (ptoscano@redhat.com)
  - 1959048: improve wording for invalid syspurpose values (ptoscano@redhat.com)
  - Enable subman to run normally in containers for development/test
    (csnyder@redhat.com)
  - Fixed reporting of AWS cloud facts (null value) (jhnidek@redhat.com)
  - cockpit: Test also system purpose (mmarusak@redhat.com)
  - cockpit: Use current PF4 components and design (mmarusak@redhat.com)
  - test: Update cockpit test/common library (mmarusak@redhat.com)
  - cockpit: Update babel (mmarusak@redhat.com)
  - cockpit: Sync lib/patternfly with Cockpit (mmarusak@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.15-1
changelog:
  - 1941904: actually disable initial-setup in RHEL >= 9, and Fedora too (#2675)
    (ptoscano@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.16-1
changelog:
  - 1941904: remove packages (#2692)
    (31166354+tlhmerry9@users.noreply.github.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Update translation files (noreply@weblate.org)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Update translation files (noreply@weblate.org)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - Move cloud detector/collector to cloud-what package (#2680)
    (jhnidek@redhat.com)
  - 1975552: add '[SUBMODULE]' in syspurpose usage string (ptoscano@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - 1973807: fix wording on error when listing syspurpose values (#2684)
    (ptoscano@redhat.com)
  - 1975552: remove extra '[OPTIONS]' from syspurpose usage string (#2682)
    (ptoscano@redhat.com)
  - Make Azure cloud collector more reliable (#2645) (jhnidek@redhat.com)
  - 1967210: Do not print warning, when valid value is provided
    (jhnidek@redhat.com)
  - 1968420: improve description of rhsm.conf format (ptoscano@redhat.com)
  - Delete server repo file (suttner@atix.de)


author: Christopher Snyder <csnyder@redhat.com> 1.29.17-1
changelog:
  - Remove no arch from python3-cloud-what package (csnyder@redhat.com)
  - 1938878: Fix issues discovered by static code analyzers (#2644)
    (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.18-1
changelog:
  - 1976324: Added cloud_what to log root namespaces (jhnidek@redhat.com)
  - 1976324: Added cloud_what to log root namespaces (jhnidek@redhat.com)
  - Slightly improve our container detection (#2611) (ptoscano@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - 1976225: read lscpu from its JSON output if available (#2699)
    (ptoscano@redhat.com)
  - 1975589: Correct typo in dnf plugin message (wpoteat@redhat.com)
  - 1924126: Fix profile upload on AWS systems (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.19-1
changelog:
  - ENT-4083: Fix flake8 error E402 (mhorky@redhat.com)
  - ENT-4085: Fix flake8 error E713 (mhorky@redhat.com)
  - 2003777: Show available organizations before asking for input
    (mhorky@redhat.com)
  - ENT-4302: Remove "u" prefix from strings (mhorky@redhat.com)
  - ENT-4326: Drop "-*- coding" comment (mhorky@redhat.com)
  - ENT-4277: Drop __future__ imports (mhorky@redhat.com)
  - 1979323: Cockpit - do not show red red icon in SCA mode (jhnidek@redhat.com)
  - Remove outdated comments from the coverage Jenkins job (mhorky@redhat.com)
  - ENT-4252: Migrate from nose to pytest (mhorky@redhat.com)
  - Debian / Ubuntu multi-architectures support
    (sbernhard@users.noreply.github.com)
  - Translated using Weblate (Spanish) (ehespinosa57@gmail.com)
  - 1859157: Display better error message on incorrect --org (mhorky@redhat.com)
  - New D-Bus method GetOrg() (jhnidek@redhat.com)
  - 1924338: list prints not status and dates in SCA mode (jhnidek@redhat.com)
  - 1983144: More useful feedback on unknown argument (mhorky@redhat.com)
  - ENT-4089: Fix flake8 error E741 (mhorky@redhat.com)
  - ENT-4090: Fix flake8 error F821 (mhorky@redhat.com)
  - Translated using Weblate (Italian) (toscano.pino@tiscali.it)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (ljanda@redhat.com)
  - ENT-4091: Fix flake8 error F841 (mhorky@redhat.com)
  - ENT-4228: Format rhsmlib exception (mhorky@redhat.com)
  - ENT-4228: Always format restlib exceptions (mhorky@redhat.com)
  - Update exception handling (mhorky@redhat.com)
  - Drop unused M2Crypto bits (ptoscano@redhat.com)
  - 1995465: Do not use deprecated collections.MutableMapping
    (jhnidek@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - 1983074: Remove invalid log level (mhorky@redhat.com)
  - ENT-4213: Remove deprecated pep8 package (mhorky@redhat.com)
  - build: switch to os.makedirs(..., exist_ok=True) (ptoscano@redhat.com)
  - build: call create_dest_dir() only when running callback
    (ptoscano@redhat.com)
  - flake8: enable E131, E714 (ptoscano@redhat.com)
  - 1859569: Abort on invalid username/token option in syspurpose commands
    (mhorky@redhat.com)
  - Drop logging.conf (ptoscano@redhat.com)
  - Drop long-dead sat5to6 script (ptoscano@redhat.com)
  - Drop RHN migration (ptoscano@redhat.com)
  - 1922151: Add /var/cache/cloud-what to python3-cloud-what RPM.
    (jhnidek@redhat.com)
  - ENT-164: Remove ga_loader importer (mhorky@redhat.com)
  - ENT-164: Drop rhsm-gtk (mhorky@redhat.com)
  - ENT-164: Drop subscription-manager-gui & rhsm-icon (mhorky@redhat.com)
  - Add minimal documentation for the plugins directories (ptoscano@redhat.com)
  - ENT-4168: Unify description of --org in syspurpose subcommands
    (mhorky@redhat.com)
  - 1922151: Use in-memory cache on AWS too (jhnidek@redhat.com)
  - Move zypper plugins to an own directory (ptoscano@redhat.com)
  - Move dnf plugins to an own directory (ptoscano@redhat.com)
  - Move libdnf plugins to an own directory (ptoscano@redhat.com)
  - Drop support for YUM plugins (ptoscano@redhat.com)
  - Drop YUM plugins (ptoscano@redhat.com)
  - Add 'syspurpose' to list of commands in manpage (mhorky@redhat.com)
  - ENT-4152: Drop initial-setup addon (mhorky@redhat.com)
  - ENT-4136: Drop firstboot support (mhorky@redhat.com)
  - ENT-3764: Change comments to follow Conscious language initiative
    (mhorky@redhat.com)
  - ENT-3764: Update variable names in hwprobe.py (mhorky@redhat.com)
  - ENT-3764: Update project URLs to new versions (mhorky@redhat.com)
  - ENT-3764: Remove BLACKLISTED_LOCALES (mhorky@redhat.com)
  - 1980418: Add 'active' field to module stream profile (ianballou67@gmail.com)
  - repos: document order of --enable & --disable (ptoscano@redhat.com)
  - 1984133: repos: respect order of --enable & --disable (ptoscano@redhat.com)
  - Include D-Bus sender in User-Agent http header; Singleton
    (jhnidek@redhat.com)
  - hwprobe.py: Fix counting cores per cpu for Fujitsu A64FX CPU
    (m.mizuma@jp.fujitsu.com)
  - flake8: enable E121, E122, E123, E126, E127, E128 (ptoscano@redhat.com)
  - flake8: disable E122 for test/test_utils.py (ptoscano@redhat.com)
  - Wrap first argument/element in function calls & containers
    (ptoscano@redhat.com)
  - Fix indentation of some continuation lines (ptoscano@redhat.com)
  - 1974641: Fix tab completion with multiple optional commands
    (mhorky@redhat.com)
  - 1876828: Try to suppress errors in stderr when not run as root
    (mhorky@redhat.com)
  - 1977452: typo in string format change Add quotes to a {filename} and remove
    an extra space. (tmerry@redhat.com)
  - Update translation files (noreply@weblate.org)
  - 1976240: Improve HTTP code/message reporting in error strings
    (mhorky@redhat.com)
  - Added new stage for running libdnf unit tests. (jhnidek@redhat.com)
  - make sure gpg key download doesn't fail because of private certs
    (sbernhard@users.noreply.github.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.20-1
changelog:
  - ENT-4279: Switch away from rhsmlib.compat.subprocess_compat
    (mhorky@redhat.com)
  - 2021578: Remove proxy server test as it is unnecessary (wpoteat@redhat.com)
  - cockpit: validate SSL connection to mock-insights (ptoscano@redhat.com)
  - cockpit: fix hostname of the fake Insights server (ptoscano@redhat.com)
  - cockpit: validate the SSL connection to candlepin (ptoscano@redhat.com)
  - cockpit: resolve hostname of service machine (ptoscano@redhat.com)
  - cockpit: use CANDLEPIN_URL consistently (ptoscano@redhat.com)
  - 1719690: Update to message formatting (wpoteat@redhat.com)
  - cockpit: account for missing insights-client on non-RHEL systems
    (ptoscano@redhat.com)
  - cockpit: skip Insights tests on non-RHEL OSes (ptoscano@redhat.com)
  - ENT-4370: Drop old dbus_interface.py (mhorky@redhat.com)
  - ENT-4278: Drop unittest2 imports (mhorky@redhat.com)
  - 1985845: Fix sub-man service-level --show (jhnidek@redhat.com)
  - spec: drop non-systemd support (ptoscano@redhat.com)
  - spec: drop support for Python < 3 (ptoscano@redhat.com)
  - spec: drop support for Fedora < 33 (ptoscano@redhat.com)
  - spec: drop support for RHEL < 8 (ptoscano@redhat.com)
  - spec: drop support for SUSE < 15 (ptoscano@redhat.com)
  - 2015173: chmod /etc/pki/entitlement/*.pem only when existing
    (ptoscano@redhat.com)
  - cockpit: port subscriptions info icons to PF4 icons (kkoukiou@redhat.com)
  - cockpit: translate some untranslated aria-labels (kkoukiou@redhat.com)
  - cockpit: Port Po2JSONPlugin to webpack 5 (kkoukiou@redhat.com)
  - cockpit: stop including PF3 - it's not used anymore (kkoukiou@redhat.com)
  - cockpit: port Insights dialog remaining non PF4 parts (kkoukiou@redhat.com)
  - cockpit: port subscriptions register dialog to Patternfly 4
    (kkoukiou@redhat.com)
  - cockpit: make default TEST_OS rhel-8-4 (kkoukiou@redhat.com)
  - cockpit: port spinners to PF4 spinners (kkoukiou@redhat.com)
  - cockpit: replace custom Revealer component with 'ExpandableSection' from PF4
    (kkoukiou@redhat.com)
  - cockpit: replace pficon and fa classes with svgs form react-icons
    (kkoukiou@redhat.com)
  - cockpit: remove jquery unused dependency (kkoukiou@redhat.com)
  - cockpit: patternfly is a normal dependency - not just dev
    (kkoukiou@redhat.com)
  - cockpit: update patternfly modules and explicitely specify react-icons
    dependency (kkoukiou@redhat.com)
  - cockpit: clean up package.json from unused dependencies and move to webpack 5
    (kkoukiou@redhat.com)
  - webpack: Use relative resolve path for npm 7 compatibility
    (kkoukiou@redhat.com)
  - cockpit: Stop using a custom Select, use the one from PF instead
    (kkoukiou@redhat.com)
  - cockpit: checkout Cockpit's PF/React/build library instead of keeping a
    direct copy of it locally (kkoukiou@redhat.com)
  - cockpit: update npmshrinkwrap file (kkoukiou@redhat.com)
  - Use pytest --forked for D-Bus unit tests (jhnidek@redhat.com)
  - Support of python3 of zypper rhsm script (suttner@atix.de)
  - 2003777: Fix organizations hint in syspurpose commands (mhorky@redhat.com)
  - Small style changes of d-bus server and d-bus unit tests (jhnidek@redhat.com)
  - * Removed GLib.threads_init() (jhnidek@redhat.com)
  - Added cleanup for one patcher; fixed some comments. (jhnidek@redhat.com)
  - cockpit: skip RHEL 9 tests using insights-client (ptoscano@redhat.com)
  - cockpit: fix system installation of subscription-manager
    (ptoscano@redhat.com)
  - cockpit: wait 5 seconds for candlepin at first (ptoscano@redhat.com)
  - cockpit: use the self-signed key in mock-insights (ptoscano@redhat.com)
  - test: Building requires gcc (mmarusak@redhat.com)
  - test: Tell tests about rhel-9 package manager (mmarusak@redhat.com)
  - facts: drop dead/unused code from CleanupCollector (ptoscano@redhat.com)
  - 1989955: use /proc/device-tree/ibm,partition-uuid on POWER LPARs
    (ptoscano@redhat.com)
  - facts: prepare _get_devicetree_uuid() for multiple files
    (ptoscano@redhat.com)
  - facts: refactor device-tree parts of VirtUuidCollector (ptoscano@redhat.com)
  - cockpit: Move from obsolete node-sass to Dart sass (martin@piware.de)
  - Cloud-what: Make saving token file more robust (jhnidek@redhat.com)
  - Fix redundant API calls to Candlepin (hyu@redhat.com)
  - Remove i-notify watchers on the end of the loop (jhnidek@redhat.com)
  - build: pin flake8 to < 4 (ptoscano@redhat.com)
  - Only rpmlint our specfiles (csnyder@redhat.com)
  - Version our obsoletes of syspurpose and the container plugin
    (csnyder@redhat.com)
  - Remove unnecessary comment and sles/suse tests (csnyder@redhat.com)
  - ENT-4273: Drop usage of six.moves (mhorky@redhat.com)
  - ENT-4379: Remove function make_utf8 (mhorky@redhat.com)
  - ENT-4087: Fix flake8 error E722 (mhorky@redhat.com)
  - make spec file SUSE / Open Build Service compliant (p.seiler@linuxmail.org)
  - 2003777: Only hint organizations if it's needed (mhorky@redhat.com)
  - Drop old GUI docs leftovers (ptoscano@redhat.com)
  - tests: drop no more needed rhsm_display (ptoscano@redhat.com)
  - build: remove old specific check for GUI file (ptoscano@redhat.com)
  - Drop async_utils & its tests (ptoscano@redhat.com)
  - Remove rhsm-icon leftovers (ptoscano@redhat.com)
  - build: remove unused detect_overindent function (ptoscano@redhat.com)
  - build: drop lxml leftovers (ptoscano@redhat.com)
  - build: drop Glade leftovers (ptoscano@redhat.com)
  - Add rhsm proxy support to apt-transport-katello (suttner@atix.de)
  - ENT-4289: Drop Sphinx (mhorky@redhat.com)
  - ENT-4340: Resolve deprecation warnings (mhorky@redhat.com)
  - Fixed one unused import of six (jhnidek@redhat.com)
  - ENT-4272: Remove Python 2 conditionals (mhorky@redhat.com)
  - ENT-4274: Remove six.assert* methods (mhorky@redhat.com)
  - ENT-4275: Switch away from six.BytesIO and six.StringIO (mhorky@redhat.com)
  - ENT-4082: Fix flake8 error E265 (mhorky@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.21-1
changelog:
  - 2020248: handle server-side consumer deletion in syspurpose commands
    (ptoscano@redhat.com)
  - connection: recognize proxy errors (ptoscano@redhat.com)


author: Christopher Snyder <csnyder@redhat.com>
changelog:
  - Ignore debian architecture ALL (schmidt@atix.de)
  - 2028894: Don't allow service-level --serverurl on registered system
    (mhorky@redhat.com)
  - 2037771: Cockpit registration dialog: enable insights by default
    (jhnidek@redhat.com)
  - 2039322: fix string representation of DMI facts (ptoscano@redhat.com)
  - Drop usage of six.python_2_unicode_compatible (ptoscano@redhat.com)
  - ENT-4588: Switch away from six iterators (mhorky@redhat.com)
  - ENT-4590: Switch away from six.callable (mhorky@redhat.com)
  - ENT-4587: Switch away from six types (mhorky@redhat.com)
  - Adding permissive coverage publishing (jmolet@redhat.com)
  - Ensure that prompted environment entry follows state of multiples
    (wpoteat@redhat.com)
  - 2026316: Do not delete cache of content_access during refresh
    (jhnidek@redhat.com)
  - More SUSE compliance (jhnidek@redhat.com)
  - Updates for non-multi-environment scenario (wpoteat@redhat.com)
  - Fix some minor issues related to syspurpose (jhnidek@redhat.com)
  - syspurpose: handle users w/o organizations (ptoscano@redhat.com)
  - service-level: drop useless check (ptoscano@redhat.com)
  - 2026286: consider user-specified --org in any case (ptoscano@redhat.com)
  - 1995032: Use multiple environments (wpoteat@redhat.com)
  - cache: fix typo in debug message (ptoscano@redhat.com)
  - Switch away from Thread.getName() (ptoscano@redhat.com)
  - Fix indentation of ProductStatus. (jhnidek@redhat.com)
  - 2028969: Do not try to load compliance status from cache (jhnidek@redhat.com)
  - Switch comma-separated join to space-separated join (schmidt@atix.de)
  - 2029927: Fix bash autocompletion (mhorky@redhat.com)
  - utils: use shutil.get_terminal_size() (ptoscano@redhat.com)
  - Remove PyXML leftovers (ptoscano@redhat.com)
  - 2026320: fix format of HTTP-date headers (ptoscano@redhat.com)
  - connection: move HTTP-date formatting to own helper (ptoscano@redhat.com)
  - Ensure datetime.timezone.utc objects for parsed UTC dates
    (ptoscano@redhat.com)
  - rhsm: drop custom which() implementation (ptoscano@redhat.com)
  - facts: switch to shutil.which() (ptoscano@redhat.com)
  - test: unconditionally use hashlib (ptoscano@redhat.com)
  - 1999048: Fixed partially subscribed product in Cockpit plugin
    (jhnidek@redhat.com)
  - test: rename tests to default pytest filename pattern (ptoscano@redhat.com)
  - Fixed last bits related to updated D-Bus Register method.
    (jhnidek@redhat.com)
  - Cockpit plugin: display syspurpose card without attributes
    (jhnidek@redhat.com)
  - 2023257: Disallowed attaching using D-Bus in SCA mode (jhnidek@redhat.com)
  - 2023257: Disallowed attaching pool in SCA mode: (jhnidek@redhat.com)
  - Refactoring of temporary disablement of dir watchers. (jhnidek@redhat.com)
  - Ignore enable_content option in RegisterWithActivationKeys()
    (jhnidek@redhat.com)
  - Use benefits of enable_content in cockpit plugin. (jhnidek@redhat.com)
  - Added enable_content option to Register() D-Bus method (jhnidek@redhat.com)
  - Added refresh() method to entitlement service (jhnidek@redhat.com)
  - Fixed issue with status cache (jhnidek@redhat.com)
  - Add information about content access mode to consumer (jhnidek@redhat.com)
  - 2024929: build: fix build on 'build' target (ptoscano@redhat.com)
  - 2023391: libdnf: respect environment CFLAGS (ptoscano@redhat.com)
  - Drop unused ssl_verify_depth config option (ptoscano@redhat.com)
  - tests: drop test_po_files.py (ptoscano@redhat.com)
  - Update translation files (noreply@weblate.org)
  - New extraction for translatable strings (ptoscano@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.23-1
changelog:
  - Ignore debian architecture ALL (schmidt@atix.de)
  - 2028894: Don't allow service-level --serverurl on registered system
    (mhorky@redhat.com)
  - 2037771: Cockpit registration dialog: enable insights by default
    (jhnidek@redhat.com)
  - 2039322: fix string representation of DMI facts (ptoscano@redhat.com)
  - Drop usage of six.python_2_unicode_compatible (ptoscano@redhat.com)
  - ENT-4588: Switch away from six iterators (mhorky@redhat.com)
  - ENT-4590: Switch away from six.callable (mhorky@redhat.com)
  - ENT-4587: Switch away from six types (mhorky@redhat.com)
  - Adding permissive coverage publishing (jmolet@redhat.com)
  - Ensure that prompted environment entry follows state of multiples
    (wpoteat@redhat.com)
  - 2026316: Do not delete cache of content_access during refresh
    (jhnidek@redhat.com)
  - More SUSE compliance (jhnidek@redhat.com)
  - Updates for non-multi-environment scenario (wpoteat@redhat.com)
  - Fix some minor issues related to syspurpose (jhnidek@redhat.com)
  - syspurpose: handle users w/o organizations (ptoscano@redhat.com)
  - service-level: drop useless check (ptoscano@redhat.com)
  - 2026286: consider user-specified --org in any case (ptoscano@redhat.com)
  - Drop the Vagrant bits (ptoscano@redhat.com)
  - 1995032: Use multiple environments (wpoteat@redhat.com)
  - cache: fix typo in debug message (ptoscano@redhat.com)
  - Switch away from Thread.getName() (ptoscano@redhat.com)
  - Fix indentation of ProductStatus. (jhnidek@redhat.com)
  - 2028969: Do not try to load compliance status from cache (jhnidek@redhat.com)
  - Switch comma-separated join to space-separated join (schmidt@atix.de)
  - 2029927: Fix bash autocompletion (mhorky@redhat.com)
  - utils: use shutil.get_terminal_size() (ptoscano@redhat.com)
  - Remove PyXML leftovers (ptoscano@redhat.com)
  - 2026320: fix format of HTTP-date headers (ptoscano@redhat.com)
  - connection: move HTTP-date formatting to own helper (ptoscano@redhat.com)
  - Ensure datetime.timezone.utc objects for parsed UTC dates
    (ptoscano@redhat.com)
  - rhsm: drop custom which() implementation (ptoscano@redhat.com)
  - facts: switch to shutil.which() (ptoscano@redhat.com)
  - test: unconditionally use hashlib (ptoscano@redhat.com)
  - 1999048: Fixed partially subscribed product in Cockpit plugin
    (jhnidek@redhat.com)
  - test: rename tests to default pytest filename pattern (ptoscano@redhat.com)
  - Fixed last bits related to updated D-Bus Register method.
    (jhnidek@redhat.com)
  - Cockpit plugin: display syspurpose card without attributes
    (jhnidek@redhat.com)
  - 2023257: Disallowed attaching using D-Bus in SCA mode (jhnidek@redhat.com)
  - 2023257: Disallowed attaching pool in SCA mode: (jhnidek@redhat.com)
  - Refactoring of temporary disablement of dir watchers. (jhnidek@redhat.com)
  - Ignore enable_content option in RegisterWithActivationKeys()
    (jhnidek@redhat.com)
  - Use benefits of enable_content in cockpit plugin. (jhnidek@redhat.com)
  - Added enable_content option to Register() D-Bus method (jhnidek@redhat.com)
  - Added refresh() method to entitlement service (jhnidek@redhat.com)
  - Fixed issue with status cache (jhnidek@redhat.com)
  - Add information about content access mode to consumer (jhnidek@redhat.com)
  - 2024929: build: fix build on 'build' target (ptoscano@redhat.com)
  - 2023391: libdnf: respect environment CFLAGS (ptoscano@redhat.com)
  - Drop unused ssl_verify_depth config option (ptoscano@redhat.com)
  - tests: drop test_po_files.py (ptoscano@redhat.com)
  - Update translation files (noreply@weblate.org)
  - New extraction for translatable strings (ptoscano@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.24-1
changelog:
  - 2023430: Cockpit: another improvement of curtain view (jhnidek@redhat.com)
  - environments: fix list for account in env-less org (ptoscano@redhat.com)
  - Reverting disabling AutoAttach() and PoolAttach() in SCA mode
    (jhnidek@redhat.com)
  - 2023430: cockpit: improve handling of main curtain view (ptoscano@redhat.com)
  - Squelch DeprecationWarning's when importing pyinotify (ptoscano@redhat.com)
  - Drop tox.ini, no more needed now (ptoscano@redhat.com)
  - flake8: improve, and integrate bits from tox.ini (ptoscano@redhat.com)
  - flake8: misc fixes in tito/tests (ptoscano@redhat.com)
  - 2035662: facts: tweak message for dmidecode warnings (ptoscano@redhat.com)
  - facts: improve/tweak logging of warnings (ptoscano@redhat.com)
  - jenkins: use custom settings for the RH internal npmjs repo
    (ptoscano@redhat.com)
  - jenkins: switch away from readFile() (ptoscano@redhat.com)
  - jenkins: simplify script filenames & labels (ptoscano@redhat.com)
  - jenkins: remove old scripts (ptoscano@redhat.com)
  - ENT-4671: Improve debug logging to stdout (mhorky@redhat.com)
  - Drop non-systemd support (ptoscano@redhat.com)
  - ENT-4650: Remove python-six from build system (mhorky@redhat.com)
  - ENT-4093: Fix flake8 warning W605 (mhorky@redhat.com)
  - ENT-4618: Switch away from six.get_method_* (mhorky@redhat.com)
  - ENT-4414: Remove RhsmIconCache (mhorky@redhat.com)
  - New extraction for translatable strings (ptoscano@redhat.com)
  - ENT-4589: Switch away from six.reraise (mhorky@redhat.com)
  - 2041968: Update man and help for environments options (wpoteat@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.29.25-1
changelog:
  - 2046516: register: do not check environments w/ activation keys
    (ptoscano@redhat.com)
  - No-op refactor of RegisterCommand._process_environments()
    (ptoscano@redhat.com)
  - 1935446: Use updated cert with SHA-256 algorithm (jhnidek@redhat.com)
  - build: pin pytest to < 7 (ptoscano@redhat.com)
  - Update translation files (noreply@weblate.org)


author: Christopher Snyder <csnyder@redhat.com> 1.29.26-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (German) (atalanttore@googlemail.com)
  - Revert "1935446: Use updated cert with SHA-256 algorithm"
    (csnyder@redhat.com)


author: Jiri Hnidek <jhnidek@redhat.com> 20220608-1
changelog:
  - New package built with tito
  - Using new version pattern for subscription-manager-rhsm-certificates


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-10
changelog:
  RHEL 9.3.0.Z ERRATUM
  - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
  Resolves: RHEL-21834
  - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
  Resolves: RHEL-21828
  - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
  Resolves: RHEL-21821


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-13
changelog:
  RHEL: 9.7.0 ERRATUM
  - sudo missing spacing and separator in log when using "--preserve-env=list"
  Resolves: RHEL-71916
  - CVE-2025-32462 sudo: LPE via host option
  Resolves: RHEL-100020


author: Alejandro López <allopez@redhat.com> - 1.9.17p2-2
changelog:
  - Request to backport support for regex in sudo [rhel-9]
  Resolves: RHEL-1376
  - Rebase of sudo to 1.9.17p2 [rhel-9]
  Resolves: RHEL-128623
  - sudo passes SHELL environment variable twice to the shell being executed [rhel-9]
  Resolves: RHEL-127359


author: Alejandro López <allopez@redhat.com> - 1.9.17p2-4
changelog:
  - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls
  Resolves: RHEL-166066


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-8
changelog:
  RHEL 9.2.0 ERRATUM
  - sudo digest check fails incorrectly for certain file sizes (SHA512/SHA384)
  Resolves: rhbz#2115789


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-9
changelog:
  RHEL 9.2.0 ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161225


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-12
changelog:
  RHEL: 9.7.0 ERRATUM
  - sudo missing spacing and separator in log when using "--preserve-env=list"
  Resolves: RHEL-71916


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-8
changelog:
  - Backport upstream changes to jailify extraction directory
    Includes related gnulib changes to add openat2
    Fixes CVE-2025-45582


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-9
changelog:
  - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277
    also, fix another tiny mistake in the patch (w/o visible consequences)


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-10
changelog:
  - Backport fix for regression in the --no-overwrite-dir option
    Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed
    in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-11
changelog:
  - Add upstream patch to improve error message for --one-top-level
    with absolute path (unsupported as a result of CVE-2025-45582 fix)


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-12
changelog:
  - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)
  - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)
    Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks).
  - Upstream fix for build with libacl 2.4.0


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-13
changelog:
  - Backport upstream patches for CVE-2026-18477, fixes a bug
    where incremental restore with cyclic renames between backups
    may create a temporary directory at an archive-controlled path
    outside the extraction tree.
    The fix for CVE-2025-45582 already prevents exploiting
    this problem, so it is more a correctness and hardening change.


author: Štěpán Horáček <shoracek@redhat.com> - 3.2.2-1
changelog:
  - Rebase to 3.2.2
  - Use systemd-sysusers to create user
    Resolves: CVE-2023-22745
    Resolves: rhbz#2095479
    Resolves: rhbz#2160307
    Resolves: rhbz#2162613


author: Jan Macku <jamacku@redhat.com> - 3:2.1.1-1
changelog:
  - rebase to 2.1.1 (RHEL-67117)
      Interpret ipv4-mapped ipv6 addresses (::ffff:A.B.C.D) as true ipv4.

  	   There are no ipv4-mapped addresses in the real network which we
  	   operate on, so use just ipv4 in such cases, but allow users
  	   to specify it this way for convenience.

  	  Return back more robast poll(2) loop handling.


author: John Kacur <jkacur@redhat.com> - 0.19-3
changelog:
  - Don't start the gui if a display is not available
  - Change to SPDX licence tag in the specfile
  Resolves: RHEL-8859


author: John Kacur <jkacur@redhat.com> - 0.19-8
changelog:
  - Fix show_threads -t and show_irqs -q to not match everything if no match
  - Fix run command failing to apply BATCH policy
  - Add -U and -K to the move command
  Resolves: RHEL-86862 RHEL-106065 RHEL-106066


author: John B. Wyatt IV <jwyatt@redhat.com> - 0.19-9
changelog:
  - Disable cpu_power from showing in help menu and checking for cpu_power
  match functionality.
  Resolves: RHEL-107847


author: John Kacur <jkacur@redhat.com> - 0.20-1
changelog:
  - Update to upstream version 0.20
  - Remove all patches (now included in upstream)
  - Remove oscilloscope (unsupported in RHEL)
  Resolves: RHEL-83079


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-50568
    - spec: create /etc/tuned/profiles directory
    - hotplug: wait for device initialization
    - sap-netweaver: increased vm.max_map_count
      resolves: RHEL-31757
    - daemon: buffer sighup signal
      resolves: RHEL-31180
    - added an option to configure profile directories
      resolves: RHEL-26157
    - api: added commands to dynamically create/destroy instances
    - functions: added 'intel_recommended_pstate'
    - functions: added 'log' which helps with debugging
    - functions: added 'package2cpus' and 'packages2uncores' matchers
    - functions: added 'lscpu' to list CPU details
    - plugins: added plugin_irq
    - plugin_video: added support for amdgpu `panel_power_savings` attribute
    - plugin_cpu: check that writes are necessary if they may cause redundant IPIs
      resolves: RHEL-25613
    - plugin_uncore: allow to configure frequency limits using percent
    - amd-pstate: added support for controlling core performance boost
    - plugin_scheduler: adjusted error logging in _set_affinity
      resolves: RHEL-46560
    - plugin_audio: enabled controller reset to fix suspend with NVIDIA
    - plugin_irq: fixed expansion of variables
    - plugin_irqbalance: switched to IRQBALANCE_BANNED_CPULIST


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-0.2.rc1
changelog:
  - fixed functions packaging and added explicit conflict with power-profiles-daemon
    related: RHEL-50568


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-50568
    - clear plugin repository when stopping tuning
    - man: add description of the balanced-battery profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-2
changelog:
  - Fixed privileged execution of arbitrary scripts by active local user,
    (CVE-2024-52336)
    Resolves: RHEL-66638
  - Added sanity checks for API methods parameters, (CVE-2024-52337)
    Resolves: RHEL-66615


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-70457
    - tuned-ppd: removed the use of StrEnum
    - tuned-ppd: fixed traceback
    - tuned-ppd: multiple fixes and updates
    - docs: plugins docs are now automatically generated from the docstrings
    - plugin_cpu: fixed no_turbo boolean option parsing
      resolves: RHEL-51760
    - plugin_cpu: allowed raw energy_performance_preference values
    - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
      resolves: RHEL-58820
    - plugin_bootloader: added variables to BLS entries only if grub is used
    - plugin_scheduler: do not assume that perf events have type attribute
    - plugin_scheduler: updated sched knobs for kernels 6.6+
    - plugin_scheduler: log process info when its affinity cannot be changed
    - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
      resolves: RHEL-72981
    - plugin_scheduler: made perf support optional
    - plugin_net: added support for hotplug and rename
      resolves: RHEL-60906
    - makefile: added support for installation to custom $BINDIR/$SBINDIR
    - functions: dropped cpuspeed support


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70457
    - sap-hana: Set transparent_hugepages to madvise
    - plugin_bootloader: export Grub variables to make them available in submenus
    - utils.commands: fixed CPU online detection when not present
    - plugin_net: handled cqe-mode-rx ethtool option
    - profiles: correct CPU governor settings


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70457
    - plugins: added missing instance parameters
    - disk: added missing remove parameter
    - plugin_scheduler: added switch to disable processing of kthreads
    - Makefile: added support for installation to custom LIBEXECDIR
    - functions: create a new parser object for each string expansion
      resolves: RHEL-75773


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.26.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-94808
    - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
    - tuned-ppd: enabled sysfs_acpi_monitor by default
    - tuned-ppd: fixed inotify watch for performance degradation
    - tuned-ppd: pinned virtual files in memory for inotify
    - fixed instance priority inheritance
    - hotplug: added fixes for device remove race condition
    - tuned-main.conf: added startup_udev_settle_wait option
    - functions: silenced errors if module kvm_intel does not exist
      resolves: RHEL-79943
    - functions: make calc_isolated_cores return CPU ranges
      resolves: RHEL-75751
    - scsi: used 'med_power_with_dipm' for SATA ALPM
    - scsi: do not set ALPM on external SATA ports
    - network_latency: Set non-zero rcutree.nohz_full_patience_delay
    - realtime: Disable appropriate P-State drivers
      resolves: RHEL-85637
    - plugin_disk: added support for MMC (MultiMediaCard) devices
    - udev: fix possible traceback in device matcher
    - udev-settle: obey udev buffer size and handle possible tracebacks
    - daemon: re-raise daemon init exception in no-daemon mode
      resolves: RHEL-71304
    - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
      resolves: RHEL-101578
    - gui: fix the profile deleter script


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.27.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-123607
    - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    - openshift: optimize TCP settings for high throughput and low latency
    - profiles: Set boost=1 in *-performance profiles
    - sap-hana: force latency to 70 us, not to C-states
    - man: fixed instance_acquire_devices example in tuned-adm man
    - spec: use correct python interpreter for documentation installation
    - sysctl: add reapply_sysctl_exclude option
    - ppd: ask tuned recommend for base profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.28.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-210923
    - scheduler: check for EPERM when setting IRQ affinity
    - bootloader: set correct permission for tempdir
      resolves: RHEL-121198
    - commands: better error msgs when creating directory and hardened dir mode
    - docs: build reference guide
    - systemd: used drop-ins for configuration
    - systemd: do not backup the drop-in configuration
    - net: add more coalescing options, filter out unsupported ones
    - cpu: do not log error if boost isn't supported
    - bootloader: add bootc loader-entries set-options-for-source support
    - cpu: fixed TypeError when load_threshold is set in a profil
    - openshift: include network-throughput profile
    - drop support for vm.laptop_mode which is deprecated in kernel 7.0
    - net: fixed ring parser to work with rx-mini and rx-jumbo
      resolves: RHEL-168025
    - lscpu_check: do not traceback on invalid regex
      resolves: RHEL-132575
    - network-latency: increase AVC cache to 8192
    - functions: use iw for Wi-Fi power saving


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.28.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-210923
    - spec: require rpm-ostree on image mode (bootc) systems


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Patsy Griffin <patsy@redhat.com> - 2024a-2
changelog:
  - Add java patch to fix incorrect calculations for
    Africa/Casablanca starting in 2027. (RHEL-26860)


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.


author: Patsy Griffin <patsy@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (RHEL-74308)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  - Update to tzdata-2025b (RHEL-84741)
    - Chile's Aysén Region moves from -04/-03
      to -03 year-round, diverging from America/Santiago and
      creating a new zone America/Coyhaique.


author: Patsy Griffin <patsy@redhat.com> - 2026a-1
changelog:
  - Update to tzdata-2026a (RHEL-154025)
    - Correct the transition times for Moldova.
    - The POSIXRULES option is now obsolete.


author: Patsy Griffin <patsy@redhat.com> - 2026b-1
changelog:
  - Update to tzdata-2026b (RHEL-170784)
    - British Columbia’s 2026-03-08 spring forward is expected
      to be its last transition as it moves to permanent -07.


author: Patsy Griffin <patsy@redhat.com> - 2026c-1
changelog:
  - Update to tzdata-2026c (RHEL-194098)
    - Alberta moved to permanent -06 on 2026-06-18.
    - Morocco moves to permanent +00 on 2026-09-20.


author: Petr Menšík <pemensik@redhat.com> - 1.24.2-2
changelog:
  - Switch TLS configuration to follow TLS sockets by crypto-policy again
    (RHEL-147860)
  - Change the default of tls-use-system-policy-versions at build-time


author: Jakub Martisko <jamartis@redhat.com> - 6.0-56
changelog:
  - Use the C crc implementation instead of the asm (i686 only, other arches already use C)
  Related: rhbz#2045075


author: Jakub Martisko <jamartis@redhat.com> - 6.0-57
changelog:
  - Fix: Unzip Fails on Large Zip Files
  - Use the patch from Debian dealing with this
  Resolves: RHEL-45994


author: Sérgio Basto <sergio@serjux.com> - 2.6.0-3
changelog:
  - Use make macros (https://src.fedoraproject.org/rpms/usb_modeswitch/pull-request/1)
  - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro


author: Sérgio Basto <sergio@serjux.com> - 2.6.1-1
changelog:
  - Update usb_modeswitch to 2.6.1
  - Drop patch1, http://www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?f=2&t=2733
  - Drop BR jimtcl-devel, if we don't install dynlink-dispatcher


author: Jiri Kucera <jkucera@redhat.com> - 1.114-3
changelog:
  - Do not use fexecve
    Script executed via fexecve has a file descriptor number in
    argv[0]. This results in unexpected output: when displaying
    the script help, a user see "Usage: <number> [options]"
    instead of "Usage: <scriptname> [options]".
    Resolves: #1984417


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.12.1-5
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz# 1951223)
  - Added CI gating tests
  - Resolves: bz #1951223


author: - Andy Walsh <awalsh@redhat.com> - 8.1.0.316-1
changelog:
  - Rebased to upstream candidate.
  - Resolves: rhbz#1955374
  - Removed all python based tools, and all management should now be done with
    LVM.
  - Resolves: rhbz#1949159
  - vdostats is now a C program
  - Resolves: rhbz#1972302


author: - Andy Walsh <awalsh@redhat.com> - 8.1.1.287-1
changelog:
  - Fixed off-by-one issue in vdostats.
  - Resolves: rhbz#1999056
  - Improved error handling and path validation in vdostats.
  - Resolves: rhbz#2004576


author: - Andy Walsh <awalsh@redhat.com> - 8.1.1.360-1
changelog:
  - Fixed vdostats output issues.
  - Resolves: rhbz#2004576
  - Removed incorrect assumptions about major device numbers in vdostats.
  - Resolves: rhbz#2045885
  - Made improvements to the vdorecover script.
  - Resolves: rhbz#2047543
  - Added a tool to make LVMVDO pools read/write so that support and
    debugging tools may access them.
  - Resolves: rhbz#2047543


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-23
changelog:
  - RHEL-112005 CVE-2025-53905 vim: Vim path traversial
  - RHEL-112009 CVE-2025-53906 vim: Vim path traversal


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26
changelog:
  - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
  - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-28
changelog:
  - Resolves: RHEL-159631 vim: Vim: Arbitrary code execution via command injection
    in glob() function


author: Than Ngo <than@redhat.com> - 2.21-30
changelog:
  - Add a check to ensure that /proc/$$/exe can be read
    thanks to mbliss@redhat.com for the report and the proposed patch
    Resolves: RHEL-101073


author: John W. Linville <linville@redhat.com> - 2019.06.03-5
changelog:
  - Remove patch preventing install of regulatory.bin.5 man page
  - Include regulatory.bin.5 man page in distributed files


author: Davide Caratti <dcaratti@redhat.com> - 1:2.10-4
changelog:
  - Explicitly allow/disallow unsafe legacy renegotiation on configuration base.
    Resolves: rhbz#2077973


author: Pavel Reichl <preichl@redhat.com> - 3.1.12-3
changelog:
  - xfsdump: restoring inventory prevents non-directory files being restored from tape,
  - actually fixed by rebase to 3.1.12
  - related: bz#2166557
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump issue
  - related: bz#2034327


author: Pavel Reichl <preichl@redhat.com> - 3.1.12-4
changelog:
  - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x
  - Related: RHEL-8000


author: Pavel Reichl <preichl@redhat.com> - 5.19.0-1
changelog:
  - New upstream release
  - Tolerate tiny (<300MB) filesystems
  - Rename xfsprogs-5.12.0-default-bigtime-inobtcnt-on.patch to
      xfsprogs-5.19.0-disable-old-kernel-bigtime-inobtcnt-on.patch
      and amend it to reflect upstream changes
  - Backport all "Fixing" patches relevant to 5.19
    Related: rhbz#2142910


author: Pavel Reichl <preichl@redhat.com> - 6.3.0-1
changelog:
  - Rebase to upstream version 6.3.0
  -
  - Following is a list of dropped backported patches which
  - are contained in the current rebase:
  - xfsprogs-5.19.0-xfs-hoist-refcount-record-merge-predicates.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs_db-fix-dir3-block-magic-check.patch (v6.1.0)
  - xfsprogs-5.19.0-xfs-estimate-post-merge-refcounts-correctly.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs-get-rid-of-assert-from-xfs_btree_islastblock.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs-fix-off-by-one-error-in-xfs_btree_space_to_heigh.patch (v6.2.0)
  - xfsprogs-5.19.0-xfs-fix-sb-write-verify-for-lazysbcount.patch (v6.1.0)
  - xfsprogs-5.19.0-xfs-removed-useless-condition-in-function-xfs_attr_n.patch (v6.0.0)
  - xfsprogs-5.19.0-xfs_repair-retain-superblock-buffer-to-avoid-write-h.patch (v6.1.0)
  -
  - Rename the remaining patches so the name contains upstream version in which
  - they are implemented, or "rhelonly".
  -
  - Drop Eric Sandeen's public key used to check tarball signature and replace it by
  - Carlos Maiolino's (current upstream xfsprogs maintainer).
  -
  - Following is a list of newly backported patches from versions released after 6.3
  - which are fixing patches present in version 6.3:
  - xfsprogs-6.4.0-xfs_repair-don-t-add-junked-entries-to-the-rebuilt-d.patch
  - xfsprogs-6.4.0-xfs_repair-don-t-spray-correcting-imap-all-by-itself.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-fixing-imap-due-to-spa.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-shortform_dir2_junk-is.patch
  -
  - Backport:
  - xfsprogs-6.4.0-xfs_db-move-obfuscate_name-assertion-to-callers.patch
  - xfsprogs-6.4.0-xfs_db-fix-metadump-name-obfuscation-for-ascii-ci-fi.patch
  - xfsprogs-6.4.0-xfs-stabilize-the-dirent-name-transformation-functio.patch
  - to implement RHEL-RHEL-8284
  -
  - Backport xfsprogs-rhelonly-xfs_quota-fix-missing-mount-point-warning.patch
  - to implement RHEL-7900
  -
  - Related: RHEL-15399
  - Related: RHEL-8284
  - Related: RHEL-7900


author: Pavel Reichl <preichl@redhat.com> - 6.4.0-1
changelog:
  - Rebase to a more recent upstream release
  - Related: RHEL-28339
  - Following is a list of dropped backported patches which
  - are contained in the current rebase:
  - xfsprogs-6.4.0-set-bnobt-cntbt-numrecs-correctly-when-formattin.patch
  - xfsprogs-6.4.0-mkfs-fix-man-s-default-value-for-sparse-option.patch
  - xfsprogs-6.4.0-xfs_repair-don-t-add-junked-entries-to-the-rebuilt-d.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-fixing-imap-due-to-spa.patch
  - xfsprogs-6.4.0-xfs_repair-don-t-spray-correcting-imap-all-by-itself.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-shortform_dir2_junk-is.patch
  - xfsprogs-6.4.0-xfs_db-move-obfuscate_name-assertion-to-callers.patch
  - xfsprogs-6.4.0-xfs_db-fix-metadump-name-obfuscation-for-ascii-ci-fi.patch
  - xfsprogs-6.4.0-xfs-stabilize-the-dirent-name-transformation-functio.patch
  -
  - Rename xfs_quota-fix-missing-mount-point-warning.patch to reflect upstream
  -	version it was merged in.


author: Bill O'Donnell <bodonnel@redhat.com> - 6.4.0-2
changelog:
  - Fix various CVE issues.
  - Related: RHEL-32996
  - Following is the patch list:
  - xfsprogs-6.5.0-xfs_db.xfs.8-xfs_db-fix-leak-in-flist_find_ftyp.patch
  - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_repair-make-duration-take-time_t.patch
  - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_scrub-don-t-call-phase_end-if-phase_rusage-was-n.patch
  - xfsprogs-6.5.0-xfs_fsr.xfs.8-xfs_fsr-convert-fsrallfs-to-use-time_t-instead-of-in.patch
  - xfsprogs-6.5.0-xfs_fsr.xfs.8-xfs_fsr-replace-atoi-with-strtol.patch
  - xfsprogs-6.5.0-xfs_db.xfs.8-xfs_db-add-helper-for-flist_find_type-for-clearer-fi.patch
  - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_repair-catch-strtol-errors.patch
  - xfsprogs-rhelonly-xfs_db-fix-unitialized-variable-in-check_parents-function.patch


author: Bill O'Donnell <bodonnel@redhat.com> - 6.4.0-3
changelog:
  - Fix coverity issue
  - Related: RHEL-39449
  - Following is the patch list:
  - xfsprogs-6.5.0-xfs.8-xfs-fix-bounds-check-in-xfs_defer_agfl_block.patch


author: Pavel Reichl <preichl@redhat.com> - 6.4.0-7
changelog:
  - xfs unrepairable filesystem if directory block not junked in phase 3 - more
  - fixes
  - Related: RHEL-54342


author: Pavel Reichl <preichl@redhat.com> - 6.4.0-8
changelog:
  - Fix FS/XFS: xfs/155 test with 64k block and
  - FS/XFS: xfs/154 test with dax
  - Related: RHEL-145813
  - Related: RHEL-146169


author: Petr Kubat <pkubat@redhat.com> - 5.2.4-7
changelog:
  - Use relative path for COPYING files so that rpm moves them to correct place
    Related: rhbz#1741074


author: Jakub Martisko <jamartis@redhat.com> - 3.0-31
changelog:
  - Add the missing linker flags
  - Add the patch that allows to configure the linker flags from the spec file
    Resolves: rhbz #2044902


author: Jakub Martisko <jamartis@redhat.com> - 3.0-33
changelog:
  - Disable the asm implementation of some functions and use the C instead
  - This should fix some of the annocheck issues
    Related: rhbz#2044902


author: Jakub Martisko <jamartis@redhat.com> - 3.0-34
changelog:
  - Fix the regression introduced in 3.0-33 that caused some of the zip build flags to be dropped
  Resolves: rhbz#2162688


author: Jakub Martisko <jamartis@redhat.com> - 3.0-35
changelog:
  - Fix the annocheck issus from 3-0-33 without reintroducing the regression from 3.0-34
  Related: rhbz#2162688


author: Patrik Novotný <panovotn@redhat.com> - 1.2.11-28
changelog:
  - IBM CRC32 optimalization rhbz#1959423
  - Enabled Z hardware-accelerated deflate for compression levels 1 through 6 (#1972057)


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11-34
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-37
changelog:
  - Rebased Power 8 optimization patches
  - Fix for Unnecessary IFUNC resolver for crc32_z
  - Fix for python3.11 broken libxml2 and lxml on s390x


