# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.67.1.rt7.408.el8_10]
changelog:
  - redhat: deprecate RTBZ (Alexandra Hájková)
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727}
  - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek)
  - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.68.1.rt7.409.el8_10]
changelog:
  - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759}
  - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991]
  - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
  - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
  - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991]
  - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991]
  - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991]
  - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928]
  - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928]
  - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
  - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
  - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928]
  - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928]
  - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376]
  - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159}
  - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.69.1.rt7.410.el8_10]
changelog:
  - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.70.1.rt7.411.el8_10]
changelog:
  - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914}
  - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717]
  - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097}
  - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600]
  - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.71.1.rt7.412.el8_10]
changelog:
  - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200}
  - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072]
  - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072]
  - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072]
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072]
  - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232]
  - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232]
  - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.72.1.rt7.413.el8_10]
changelog:
  - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332}
  - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371]
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211}
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696}
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477}
  - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976]
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894]
  - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313]
  - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181]
  - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369]
  - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369]
  - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369]
  - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464}
  - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758]
  - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758]
  - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758]
  - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758]
  - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758]
  - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758]
  - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758]
  - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758]
  - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758]
  - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758]
  - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758]
  - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758]
  - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758]
  - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758]
  - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758]
  - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758]
  - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758]
  - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758]
  - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758]
  - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758]
  - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.73.1.rt7.414.el8_10]
changelog:
  - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360]
  - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360]
  - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234]
  - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985}
  - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.74.1.rt7.415.el8_10]
changelog:
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.75.1.rt7.416.el8_10]
changelog:
  - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812]
  - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453]
  - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376]
  - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350}
  - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350}
  - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350}
  - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107}
  - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932}
  - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392}
  - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449}
  - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449}
  - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713]
  - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160]
  - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655]
  - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655]
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125}
  - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125}
  - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.76.1.rt7.417.el8_10]
changelog:
  - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498}
  - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193]
  - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461}


author: John Kacur <jkacur@redhat.com> - 3.5-4
changelog:
  - Add check to catch python-dmidecode if it fails
  Resolves: rhbz#2168373
  jiraProject == RHELPLAN-148048


author: John Kacur <jkacur@redhat.com> - 3.5-5
changelog:
  - Added code to check if the /proc/net/if_net6 file exists.
  Resolves: rhbz#2210106
  jiraProject == RHELPLAN-158239


author: John Kacur <jkacur@redhat.com> - 3.5-6
changelog:
  - Add tests/tests.yml and tests/scripts/run_tests.sh for gating
  Resolves: rhbz#2213609
  jiraProject == RHELPLAN-159326


author: Tomas Glozar <tglozar@redhat.com> - 3.5-9
changelog:
  - Added patch set that enables rteval to do load calculations and reporting
  correctly on systems with isolated CPUs
  jiraProject== RHEL-8680


author: John Kacur <jkacur@redhat.com> - 3.7-1
changelog:
  - Rebase to upstream rteval-3.7
  - Revert the change to use a newer default kernel
  Resolves: RHEL-8967


author: John Kacur <jkacur@redhat.com> - 3.7-3
changelog:
  - Add an rpminspect file to pass gating which is failing due to
    python egg-info directory permissions
  Resolves: RHEL-16401


author: John Kacur <jkacur@redhat.com> - 1.4-13
changelog:
  - Rebuild rteval-build with a fixed binutils in brew
  - Bump the release number of stress-ng as well
  Resolves: rhbz#1954451


