# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.125.1.rt7.466.el8_10]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176090] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Rafael Aquini) [RHEL-176445] {CVE-2026-46333}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.126.1.rt7.467.el8_10]
changelog:
  - crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772]
  - crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772]
  - crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772]
  - crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772]
  - crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772]
  - crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772]
  - crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772]
  - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772]
  - crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772]
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815]
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815]
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815]
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815]
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709}
  - smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815]
  - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815]
  - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815]
  - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190}
  - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532}
  - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532}
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408}
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408}
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408}
  - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408}
  - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408}
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684}
  - smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032]
  - smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032]
  - smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032]
  - smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032]
  - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032]
  - smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032]
  - smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032]
  - smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032]
  - smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032]
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183}
  - selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219]
  - selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219]
  - bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219]
  - bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219]
  - bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219]
  - bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219]
  - bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219]
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219]
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455}
  - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347}
  - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243}
  - Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890]
  - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890]
  - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890]
  - Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890]
  - Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890]
  - Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890]
  - Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890]
  - Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890]
  - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890]
  - Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890]
  - Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890]
  - Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890]
  - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890]
  - Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890]
  - Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890]
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890]
  - Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890]
  - Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890]
  - Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890]
  - Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890]
  - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890]
  - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981}
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270}
  - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.127.1.rt7.468.el8_10]
changelog:
  - smc: Fix use-after-free in tcp_write_timer_handler(). (Steve Best) [RHEL-167084] {CVE-2023-53781}
  - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166939] {CVE-2025-68366}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143892] {CVE-2026-22984}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143874] {CVE-2026-22990}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.128.1.rt7.469.el8_10]
changelog:
  - smb: client: fix OOB reads parsing symlink error response (Paulo Alcantara) [RHEL-171465] {CVE-2026-31613}
  - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Antoine Tenart) [RHEL-168961]
  - geneve: Fix use-after-free in geneve_find_dev(). (Antoine Tenart) [RHEL-168961] {CVE-2025-21858}
  - netfilter: nf_tables: release flowtable after rcu grace period on error (Florian Westphal) [RHEL-160514] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.129.1.rt7.470.el8_10]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178938] {CVE-2026-46243}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.130.1.rt7.471.el8_10]
changelog:
  - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852}
  - md: uninitialized start_time in md_clone_bio() causes bogus IO accounting (Nigel Croxon) [RHEL-170384]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.131.1.rt7.472.el8_10]
changelog:
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-178447]
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664] {CVE-2026-43038}
  - ALSA: 6fire: Fix leftover global pointers after probe failures (Jaroslav Kysela) [RHEL-172963]
  - ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex (Jaroslav Kysela) [RHEL-172963]
  - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581}
  - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.132.1.rt7.473.el8_10]
changelog:
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037}
  - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125}
  - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.134.1.rt7.475.el8_10]
changelog:
  - wifi: mac80211: remove station if connection prep fails (Jose Ignacio Tornos Martinez) [RHEL-180120] {CVE-2026-46125}
  - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180058] {CVE-2026-46152}
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179360] {CVE-2026-46056}
  - netfilter: flowtable: strictly check for maximum number of actions (Florian Westphal) [RHEL-176909] {CVE-2026-43329}
  - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-176909] {CVE-2026-43329}
  - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171500] {CVE-2026-31669}
  - xen/privcmd: fix double free via VMA splitting (Vitaly Kuznetsov) [RHEL-172482] {CVE-2026-31787}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173853] {CVE-2026-43110}


author: John Kacur <jkacur@redhat.com> - 3.5-4
changelog:
  - Add check to catch python-dmidecode if it fails
  Resolves: rhbz#2168373
  jiraProject == RHELPLAN-148048


author: John Kacur <jkacur@redhat.com> - 3.5-5
changelog:
  - Added code to check if the /proc/net/if_net6 file exists.
  Resolves: rhbz#2210106
  jiraProject == RHELPLAN-158239


author: John Kacur <jkacur@redhat.com> - 3.5-6
changelog:
  - Add tests/tests.yml and tests/scripts/run_tests.sh for gating
  Resolves: rhbz#2213609
  jiraProject == RHELPLAN-159326


author: Tomas Glozar <tglozar@redhat.com> - 3.5-9
changelog:
  - Added patch set that enables rteval to do load calculations and reporting
  correctly on systems with isolated CPUs
  jiraProject== RHEL-8680


author: John Kacur <jkacur@redhat.com> - 3.7-1
changelog:
  - Rebase to upstream rteval-3.7
  - Revert the change to use a newer default kernel
  Resolves: RHEL-8967


author: John Kacur <jkacur@redhat.com> - 3.7-3
changelog:
  - Add an rpminspect file to pass gating which is failing due to
    python egg-info directory permissions
  Resolves: RHEL-16401


author: John Kacur <jkacur@redhat.com> - 1.4-13
changelog:
  - Rebuild rteval-build with a fixed binutils in brew
  - Bump the release number of stress-ng as well
  Resolves: rhbz#1954451


