-
Wed Mar 26 2025 Darren Archibald <darren.archibald@oracle.com> [5.14.0-503.34.1.el9_5.OL9]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
-
Mon Mar 17 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.34.1.el9_5]
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82734] {CVE-2025-21785}
- crypto: rng - Fix extrng EFAULT handling (Herbert Xu) [RHEL-70643]
-
Wed Mar 12 2025 Chao YE <cye@redhat.com> [5.14.0-503.33.1.el9_5]
- scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-62266]
- scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-62266]
- scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-62266]
- x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Chris von Recklinghausen) [RHEL-62210]
-
Sun Mar 09 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.32.1.el9_5]
- SUNRPC: Handle -ETIMEDOUT return from tlshd (Benjamin Coddington) [RHEL-79870]
- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (Benjamin Coddington) [RHEL-79870]
- tls: Fix tls_sw_sendmsg error handling (Benjamin Coddington) [RHEL-79870]
- SUNRPC: Fix a hang in TLS sock_close if sk_write_pending (Benjamin Coddington) [RHEL-79870]
-
Thu Mar 06 2025 Chao YE <cye@redhat.com> [5.14.0-503.31.1.el9_5]
- HID: core: zero-initialize the report buffer (Benjamin Tissoires) [RHEL-81838] {CVE-2024-50302}
- x86/kaslr: Expose and use the end of the physical memory address space (Waiman Long) [RHEL-70002]
- ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81799]
- ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81799]
- ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81799] {CVE-2024-53197}
- ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81799]
- x86/kexec: Add EFI config table identity mapping for kexec kernel (Jay Shin) [RHEL-74170]
- mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (Jay Shin) [RHEL-73210] {CVE-2024-53113}
- can: bcm: Fix UAF in bcm_proc_show() (CKI KWF BOT) [RHEL-80746] {CVE-2023-52922}
- smb: client: fix chmod(2) regression with ATTR_READONLY (Jay Shin) [RHEL-80526]
- hugetlb: prioritize surplus allocation from current node (Aristeu Rozanski) [RHEL-77488]
- dev: Acquire netdev_rename_lock before restoring dev->name in dev_change_name(). (Antoine Tenart) [RHEL-77338]
- net: add softirq safety to netdev_rename_lock (Antoine Tenart) [RHEL-77343]
- arp: Convert ioctl(SIOCGARP) to RCU. (Antoine Tenart) [RHEL-77343]
- net: Protect dev->name by seqlock. (Antoine Tenart) [RHEL-77343]
- net: Remove unused declaration dev_restart() (Antoine Tenart) [RHEL-77343]
- arp: Get dev after calling arp_req_(delete|set|get)(). (Antoine Tenart) [RHEL-77343]
- arp: Remove a nest in arp_req_get(). (Antoine Tenart) [RHEL-77343]
- arp: Factorise ip_route_output() call in arp_req_set() and arp_req_delete(). (Antoine Tenart) [RHEL-77343]
- arp: Validate netmask earlier for SIOCDARP and SIOCSARP in arp_ioctl(). (Antoine Tenart) [RHEL-77343]
- arp: Move ATF_COM setting in arp_req_set(). (Antoine Tenart) [RHEL-77343]
- ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-75250] {CVE-2023-52605}
- vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-75461] {CVE-2024-50264}
- x86/pci: Skip early E820 check for ECAM region (CKI Backport Bot) [RHEL-67065]
- cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids (Steve Best) [RHEL-64291]
-
Sun Mar 02 2025 Patrick Talbert <ptalbert@redhat.com> [5.14.0-503.30.1.el9_5]
- can: bcm: Fix UAF in bcm_proc_show() (CKI KWF BOT) [RHEL-80746] {CVE-2023-52922}
- smb: client: fix chmod(2) regression with ATTR_READONLY (Jay Shin) [RHEL-80526]
- hugetlb: prioritize surplus allocation from current node (Aristeu Rozanski) [RHEL-77488]
- dev: Acquire netdev_rename_lock before restoring dev->name in dev_change_name(). (Antoine Tenart) [RHEL-77338]
- net: add softirq safety to netdev_rename_lock (Antoine Tenart) [RHEL-77343]
- arp: Convert ioctl(SIOCGARP) to RCU. (Antoine Tenart) [RHEL-77343]
- net: Protect dev->name by seqlock. (Antoine Tenart) [RHEL-77343]
- net: Remove unused declaration dev_restart() (Antoine Tenart) [RHEL-77343]
- arp: Get dev after calling arp_req_(delete|set|get)(). (Antoine Tenart) [RHEL-77343]
- arp: Remove a nest in arp_req_get(). (Antoine Tenart) [RHEL-77343]
- arp: Factorise ip_route_output() call in arp_req_set() and arp_req_delete(). (Antoine Tenart) [RHEL-77343]
- arp: Validate netmask earlier for SIOCDARP and SIOCSARP in arp_ioctl(). (Antoine Tenart) [RHEL-77343]
- arp: Move ATF_COM setting in arp_req_set(). (Antoine Tenart) [RHEL-77343]
- ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-75250] {CVE-2023-52605}
- vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-75461] {CVE-2024-50264}
- x86/pci: Skip early E820 check for ECAM region (CKI Backport Bot) [RHEL-67065]
- cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids (Steve Best) [RHEL-64291]
-
Tue Feb 25 2025 Chao YE <cye@redhat.com> [5.14.0-503.29.1.el9_5]
- rhel-9.5: gate on kernel-qe tests results not cki ones (Bruno Goncalves)
- ice: implement low latency PHY timer updates (Petr Oros) [RHEL-75466]
- ice: check low latency PHY timer update firmware capability (Petr Oros) [RHEL-75466]
- ice: add lock to protect low latency interface (Petr Oros) [RHEL-75466]
- ice: rename TS_LL_READ* macros to REG_LL_PROXY_H_* (Petr Oros) [RHEL-75466]
- ice: use read_poll_timeout_atomic in ice_read_phy_tstamp_ll_e810 (Petr Oros) [RHEL-75466]
- smb: client: get rid of kstrdup() in get_ses_refpath() (Paulo Alcantara) [RHEL-72875]
- smb: client: fix noisy when tree connecting to DFS interlink targets (Paulo Alcantara) [RHEL-72875]
- smb: client: don't trust DFSREF_STORAGE_SERVER bit (Paulo Alcantara) [RHEL-72875]
- smb: client: don't check for @leaf_fullpath in match_server() (Paulo Alcantara) [RHEL-72875]
- smb: client: get rid of TCP_Server_Info::refpath_lock (Paulo Alcantara) [RHEL-72875]
- smb: client: don't retry DFS targets on server shutdown (Paulo Alcantara) [RHEL-72875]
- smb: client: fix return value of parse_dfs_referrals() (Paulo Alcantara) [RHEL-72875]
- smb: client: optimize referral walk on failed link targets (Paulo Alcantara) [RHEL-72875]
- smb: client: provide dns_resolve_{unc,name} helpers (Paulo Alcantara) [RHEL-72875]
- smb: client: parse DNS domain name from domain= option (Paulo Alcantara) [RHEL-72875]
- smb: client: fix DFS mount against old servers with NTLMSSP (Paulo Alcantara) [RHEL-72875]
- smb: client: parse av pair type 4 in CHALLENGE_MESSAGE (Paulo Alcantara) [RHEL-72875]
- smb: client: introduce av_for_each_entry() helper (Paulo Alcantara) [RHEL-72875]
- smb: client: fix double free of TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-72875]
- cifs: support mounting with alternate password to allow password rotation (Paulo Alcantara) [RHEL-72875]
- cifs: support reconnect with alternate password for SMB1 (Paulo Alcantara) [RHEL-72875]
- smb: client: sync the root session and superblock context passwords before automounting (Paulo Alcantara) [RHEL-72875]
- cifs: unlock on error in smb3_reconfigure() (Paulo Alcantara) [RHEL-72875]
- cifs: during remount, make sure passwords are in sync (Paulo Alcantara) [RHEL-72875]
- smb: client: Handle kstrdup failures for passwords (Paulo Alcantara) [RHEL-72875] {CVE-2024-50120}
- smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-72875] {CVE-2024-54680}
- smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-72875] {CVE-2024-53095}
- Fix spelling errors in Server Message Block (Paulo Alcantara) [RHEL-72875]
- af_packet: do not call packet_read_pending() from tpacket_destruct_skb() (CKI Backport Bot) [RHEL-78423]
-
Wed Feb 19 2025 Chao YE <cye@redhat.com> [5.14.0-503.28.1.el9_5]
- bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (CKI Backport Bot) [RHEL-73726]
- intel_idle: Disable promotion to C1E on Jasper Lake and Elkhart Lake (David Arcari) [RHEL-62985]
- intel_idle: add Granite Rapids Xeon support (David Arcari) [RHEL-62985]
- intel_idle: Switch to new Intel CPU model defines (David Arcari) [RHEL-62985]
- x86/resctrl: Remove redundant variable in mbm_config_write_domain() (David Arcari) [RHEL-59001]
- x86/resctrl: Read supported bandwidth sources from CPUID (David Arcari) [RHEL-59001]
- x86/resctrl: Remove hard-coded memory bandwidth limit (David Arcari) [RHEL-59001]
- mei: me: disable RPL-S on SPS and IGN firmwares (CKI Backport Bot) [RHEL-60895]
- smb: client: change return value in open_cached_dir_by_dentry() if !cfids (Jay Shin) [RHEL-75935]
- smb: client: disable directory caching when dir_cache_timeout is zero (Jay Shin) [RHEL-75935]
- smb: client: remove unnecessary checks in open_cached_dir() (Jay Shin) [RHEL-75935]
- smb: prevent use-after-free due to open_cached_dir error paths (Jay Shin) [RHEL-75935] {CVE-2024-53177}
- smb: Don't leak cfid when reconnect races with open_cached_dir (Jay Shin) [RHEL-75935] {CVE-2024-53178}
- smb3: request handle caching when caching directories (Jay Shin) [RHEL-75935]
- bnxt_en: Unregister PTP during PCI shutdown and suspend (Michal Schmidt) [RHEL-69514]
- bnxt_en: Refactor bnxt_ptp_init() (Michal Schmidt) [RHEL-69514]
- smb: client: ignore unhandled reparse tags (Jay Shin) [RHEL-77743]
- smb: client: fix oops due to unset link speed (Jay Shin) [RHEL-77359]
-
Wed Feb 12 2025 Chao YE <cye@redhat.com> [5.14.0-503.27.1.el9_5]
- NFS: enable nconnect for RDMA (Benjamin Coddington) [RHEL-77179]
- Revert "scsi: lpfc: Early return after marking final NLP_DROPPED flag in dev_loss_tmo" (Dick Kennedy) [RHEL-70933]
- idpf: fix idpf_vc_core_init error path (CKI Backport Bot) [RHEL-70191]
- idpf: avoid vport access in idpf_get_link_ksettings (CKI Backport Bot) [RHEL-70191]
- ip6mr: fix tables suspicious RCU usage (Andrea Claudi) [RHEL-71730]
- ipmr: tune the ipmr_can_free_table() checks. (Andrea Claudi) [RHEL-71730]
- ipmr: add debug check for mr table cleanup (Andrea Claudi) [RHEL-71730]
- net: ip6mr: add RTM_GETROUTE netlink op (Andrea Claudi) [RHEL-71730]
- i40e: add ability to reset VF for Tx and Rx MDD events (Michal Schmidt) [RHEL-75972]
- tcp: fix mptcp DSS corruption due to large pmtu xmit (Paolo Abeni) [RHEL-62215]
- mptcp: handle consistently DSS corruption (Paolo Abeni) [RHEL-62215]
-
Mon Feb 10 2025 Chao YE <cye@redhat.com> [5.14.0-503.26.1.el9_5]
- redhat: drop Y issues from changelog (Jan Stancek)
- media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CKI Backport Bot) [RHEL-78075] {CVE-2024-53104}