# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.65.1.rt7.406.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.65.1.rt7.406.el8_10
  - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422]
  - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.66.1.rt7.407.el8_10]
changelog:
  - [rt] build kernel-rt-4.18.0-553.66.1.rt7.407.el8_10
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415]
  - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079}
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077}
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698]
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698]
  - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680}
  - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095}
  - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698]
  - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079]
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052}
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.67.1.rt7.408.el8_10]
changelog:
  - redhat: deprecate RTBZ (Alexandra Hájková)
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727}
  - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek)
  - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.68.1.rt7.409.el8_10]
changelog:
  - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759}
  - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991]
  - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
  - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
  - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991]
  - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991]
  - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991]
  - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928]
  - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928]
  - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
  - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
  - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928]
  - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928]
  - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376]
  - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159}
  - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.69.1.rt7.410.el8_10]
changelog:
  - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.70.1.rt7.411.el8_10]
changelog:
  - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914}
  - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717]
  - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097}
  - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600]
  - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.71.1.rt7.412.el8_10]
changelog:
  - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200}
  - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072]
  - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072]
  - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072]
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072]
  - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232]
  - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232]
  - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.72.1.rt7.413.el8_10]
changelog:
  - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332}
  - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371]
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211}
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696}
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477}
  - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976]
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894]
  - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313]
  - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181]
  - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369]
  - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369]
  - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369]
  - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464}
  - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758]
  - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758]
  - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758]
  - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758]
  - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758]
  - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758]
  - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758]
  - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758]
  - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758]
  - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758]
  - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758]
  - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758]
  - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758]
  - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758]
  - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758]
  - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758]
  - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758]
  - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758]
  - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758]
  - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758]
  - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.73.1.rt7.414.el8_10]
changelog:
  - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360]
  - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360]
  - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234]
  - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985}
  - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.74.1.rt7.415.el8_10]
changelog:
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352}


