<?xml version="1.0" encoding="UTF-8"?>
<updates>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2024-12834</id>
    <title> libgcrypt  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2024-11-21 00:00:00"/>
    <updated date="2024-11-21 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[1.10.0-11_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35961378]
- Update FIPS module name for Oracle Linux [Orabug: 35961378]

[1.10.0-11]
- Fix CVE-2024-2236 (RHEL-34579)</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2024-12834.html" type="self" title="ELBA-2024-12834" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="libgcrypt" version="1.10.0" release="11.el9_fips" epoch="10" arch="aarch64">
          <filename>libgcrypt-1.10.0-11.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">bfe9a4f7d4a01b4ceef501f2e07a944248aa4deb224b58df1b0f23fdcfcb0417</sum>
        </package>
        <package name="libgcrypt-devel" version="1.10.0" release="11.el9_fips" epoch="10" arch="aarch64">
          <filename>libgcrypt-devel-1.10.0-11.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">22186eae7690cb6fb6142f20c23ae9fcfbfc611bb3e31ff6c6570668a0bf5d78</sum>
        </package>
        <package name="libgcrypt" version="1.10.0" release="11.el9_fips" epoch="10" arch="src">
          <filename>libgcrypt-1.10.0-11.el9_fips.src.rpm</filename>
          <sum type="sha256">b645b71262c31e2be75429d6847256a8d97fbdfe2d23d6b633ed21c6c9fa57b6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2026-50012</id>
    <title> openssl  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2026-01-14 00:00:00"/>
    <updated date="2026-01-14 00:00:00"/>
    <rights>Copyright 2026 Oracle, Inc.</rights>
    <description>[3.5.1-5.0.1_fips]
- Update additional upstream references
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name [Orabug: 35824276]

[3.5.1-5.0.1]
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]

[3.5.1.openela.0.1]
- Add OpenELA specific changes

[1:3.5.1-5]
- Do not make key share choice in tls1_set_groups()
  Resolves: RHEL-131010</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2026-50012.html" type="self" title="ELBA-2026-50012" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="openssl-perl" version="3.5.1" release="5.0.1.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-perl-3.5.1-5.0.1.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">8fb464f4c2837e2d097bed1171f97bb6e4ed3642f6d4813def5daa27816cba41</sum>
        </package>
        <package name="openssl-devel" version="3.5.1" release="5.0.1.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-devel-3.5.1-5.0.1.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">7756ebe2df4baffae5b2939d461cca4cec13cf8ff38cd635ebc176eeef4496b7</sum>
        </package>
        <package name="openssl" version="3.5.1" release="5.0.1.el9_7_fips" epoch="10" arch="src">
          <filename>openssl-3.5.1-5.0.1.el9_7_fips.src.rpm</filename>
          <sum type="sha256">448e604e57b1aaabe23c101eda4a0f8f1db65847ebad113792fe3dcab212a1fe</sum>
        </package>
        <package name="openssl" version="3.5.1" release="5.0.1.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-3.5.1-5.0.1.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">5ba59216abf4cfd18739c78cc5e47d0921dc02b1ec7d16e7e1954ffafb93b446</sum>
        </package>
        <package name="openssl-libs" version="3.5.1" release="5.0.1.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-libs-3.5.1-5.0.1.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">f2b79fd893735bb92408751d100397a3c7befc0de80916ae400092398af498d9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2024-12341</id>
    <title> openssl  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2024-04-23 00:00:00"/>
    <updated date="2024-04-23 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[1:3.0.7-25.0.1_fips]
- Replace upstream references in fips man pages [Orabug: 35824276]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name and remove upstream references from
  fips_module_indicators manpage [Orabug: 35824276]

[1:3.0.7-25.0.1]
- Replace upstream references [Orabug: 34340177]

[1:3.0.7-25]
- Provide relevant diagnostics when FIPS checksum is corrupted
  Resolves: RHEL-5317
- Don't limit using SHA1 in KDFs in non-FIPS mode.
  Resolves: RHEL-5295
- Provide empty evp_properties section in main OpenSSL configuration file
  Resolves: RHEL-11439
- Avoid implicit function declaration when building openssl
  Resolves: RHEL-1780
- Forbid explicit curves when created via EVP_PKEY_fromdata
  Resolves: RHEL-5304
- AES-SIV cipher implementation contains a bug that causes it to ignore empty
  associated data entries (CVE-2023-2975)
  Resolves: RHEL-5302
- Excessive time spent checking DH keys and parameters (CVE-2023-3446)
  Resolves: RHEL-5306
- Excessive time spent checking DH q parameter value (CVE-2023-3817)
  Resolves: RHEL-5308
- Fix incorrect cipher key and IV length processing (CVE-2023-5363)
  Resolves: RHEL-13251
- Switch explicit FIPS indicator for RSA-OAEP to approved following
  clarification with CMVP
  Resolves: RHEL-14083
- Backport the check required by SP800-56Br2 6.4.1.2.1 (3.c)
  Resolves: RHEL-14083
- Add missing ECDH Public Key Check in FIPS mode
  Resolves: RHEL-15990
- Excessive time spent in DH check/generation with large Q parameter value (CVE-2023-5678)
  Resolves: RHEL-15954</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2024-12341.html" type="self" title="ELBA-2024-12341" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="openssl-devel" version="3.0.7" release="25.0.1.el9_3_fips" epoch="10" arch="aarch64">
          <filename>openssl-devel-3.0.7-25.0.1.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">b35eed417618a4de9f30c4dd9793246cefc2a95a509208290e2acd49c412a771</sum>
        </package>
        <package name="openssl-perl" version="3.0.7" release="25.0.1.el9_3_fips" epoch="10" arch="aarch64">
          <filename>openssl-perl-3.0.7-25.0.1.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">43b926db1c0f2db8ef02533b8dad399c79227a496a090cb96b08c0404795086a</sum>
        </package>
        <package name="openssl" version="3.0.7" release="25.0.1.el9_3_fips" epoch="10" arch="src">
          <filename>openssl-3.0.7-25.0.1.el9_3_fips.src.rpm</filename>
          <sum type="sha256">915cc393a8d7f831de0929c5561a0224e48557a359b23b1da0fb294821ebfe19</sum>
        </package>
        <package name="openssl" version="3.0.7" release="25.0.1.el9_3_fips" epoch="10" arch="aarch64">
          <filename>openssl-3.0.7-25.0.1.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">ff0af8a6e27fb0a429169c4614495389e78641d4f9c2fdba028bfd2da096f68a</sum>
        </package>
        <package name="openssl-libs" version="3.0.7" release="25.0.1.el9_3_fips" epoch="10" arch="aarch64">
          <filename>openssl-libs-3.0.7-25.0.1.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">696b2f0ed14cb1069a5d276217efa272c08004d79c5eef09412d73c4af9ef0ae</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2026-50149</id>
    <title>gnutls security update</title>
    <severity>Moderate</severity>
    <release>Oracle Linux 9</release>
    <issued date="2026-03-12 00:00:00"/>
    <updated date="2026-03-12 00:00:00"/>
    <rights>Copyright 2026 Oracle, Inc.</rights>
    <description>[3.8.3-10_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35925409]
- Update FIPS module name for Oracle Linux [Orabug: 35925409]

[3.8.3-10]
- Fix PKCS#11 token initialization label overflow (CVE-2025-9820)
- Fix name constraint processing performance issue (CVE-2025-14831)</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2026-50149.html" type="self" title="ELSA-2026-50149" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-14831.html" id="CVE-2025-14831" type="cve" title="CVE-2025-14831" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-9820.html" id="CVE-2025-9820" type="cve" title="CVE-2025-9820" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="gnutls-c++" version="3.8.3" release="10.el9_7_fips" epoch="10" arch="aarch64">
          <filename>gnutls-c++-3.8.3-10.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">b15059d54e55bd6369c8c7607810cf87dcf09103efec107f0c5e164a80e6f2ff</sum>
        </package>
        <package name="gnutls-utils" version="3.8.3" release="10.el9_7_fips" epoch="10" arch="aarch64">
          <filename>gnutls-utils-3.8.3-10.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">8273baed76e4b4e08040598af2a43bce0a50d054be5c22ecf075e218b622cab7</sum>
        </package>
        <package name="gnutls-devel" version="3.8.3" release="10.el9_7_fips" epoch="10" arch="aarch64">
          <filename>gnutls-devel-3.8.3-10.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">5fb31c44bb087492fa8450ad477092fb3c43bfda975fffdbb01b2a899741928a</sum>
        </package>
        <package name="gnutls-dane" version="3.8.3" release="10.el9_7_fips" epoch="10" arch="aarch64">
          <filename>gnutls-dane-3.8.3-10.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">a60d5bd21fe2d0226294292c848a3a230dd69756194500d15c5b415bf9670d84</sum>
        </package>
        <package name="gnutls" version="3.8.3" release="10.el9_7_fips" epoch="10" arch="src">
          <filename>gnutls-3.8.3-10.el9_7_fips.src.rpm</filename>
          <sum type="sha256">417af6f807dae4c103ec21bf36295c4fb0af7686ca422a6bc6257c171b28f92a</sum>
        </package>
        <package name="gnutls" version="3.8.3" release="10.el9_7_fips" epoch="10" arch="aarch64">
          <filename>gnutls-3.8.3-10.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">6adccd13e28ad67d0e8c300c57bfa3515822dd1ad8ab88f78937414d543ad068</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2024-12669</id>
    <title> nss  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2024-09-18 00:00:00"/>
    <updated date="2024-09-18 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[3.101.0-7.el9_u2_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35862190]
- Update FIPS module name for Oracle Linux [Orabug: 35862190]

[3.101.0-7]
- fix cms abi breakage
- fix long password issue on pbmac encodings

[3.101.0-6]
- fix param encoding in pkcs12 pbamac encoding
- add support for certificate compression in selfserv and tstclient

[3.101.0-3]
- Fix missing and inaccurate key length checks
- Fix chacha timing issue

[3.101.0-2]
- Fix MD-5 decode issue in pkcs #12
- turn off policy processing for pkcs12 and smime
- restore the rhel9 pkcs12 defaults for pk12util

[3.101.0-1]
- Rebase to NSS 3.101
- restore ppc init support</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2024-12669.html" type="self" title="ELBA-2024-12669" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="nss-pkcs11-devel" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-pkcs11-devel-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">54f8281c15fe4cd34851a62c9b2f830b67a5fc872c3b8eba023b596dec4174fb</sum>
        </package>
        <package name="nss-softokn-devel" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-devel-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">2c83830a053a481dc2df53b89adfefd4ab664e0c2bf6c07e9fbfe05c0b8b438d</sum>
        </package>
        <package name="nspr" version="4.35.0" release="14.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nspr-4.35.0-14.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">3f007124dcb3d7a115d6e684846a36a70937c7c4b1962ea9ca9f232f1cffc6e4</sum>
        </package>
        <package name="nss-softokn" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">b5e239eebea28f9b67c1ad47d123efe731756affe8eacc23ceec72be8cdf9024</sum>
        </package>
        <package name="nss-sysinit" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-sysinit-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">8aec06ddb0689971d6c14065f8be260524bd4029e6ce216f19caa28fc9eca8a7</sum>
        </package>
        <package name="nss-tools" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-tools-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">5fbe46e587e9af16f7b51106dedf039c913f027cb39fe65712a6202b0cccc552</sum>
        </package>
        <package name="nss" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="src">
          <filename>nss-3.101.0-7.el9_2_fips.src.rpm</filename>
          <sum type="sha256">e9f076489db55ad15e7b084c16d25256a60eef6a0ab46c36f1de69089ca8f6a6</sum>
        </package>
        <package name="nss-util" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-util-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">f5ab4c4fa0fb8714539c078aad4dc1edb3df9268910e7c4fd77e1f134b0def92</sum>
        </package>
        <package name="nss-util-devel" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-util-devel-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">abd763e2e9ba73e3e2df8f727ebc235ee28fa544f5f593dfed470f7879850f9a</sum>
        </package>
        <package name="nspr-devel" version="4.35.0" release="14.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nspr-devel-4.35.0-14.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">b0164f3253c1dd29a2a26da88555def875b2c1af074880eb45d360963bee5aef</sum>
        </package>
        <package name="nss" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">a914c09cf0a02219947971e547622ba513c388d98c0973809028d9e94427936f</sum>
        </package>
        <package name="nss-softokn-freebl" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">ff9aef31b7bfc3100354dfa723d1f0e8f44bff438b6db98e1d9098ae63fabb68</sum>
        </package>
        <package name="nss-softokn-freebl-devel" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-devel-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">44d49d3a8a95b413c8725ac0772953d4b616961f1eb5e755196ee496edb30313</sum>
        </package>
        <package name="nss-devel" version="3.101.0" release="7.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-devel-3.101.0-7.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">2a363a5cb555f9c0d3dba75e64fd1d882b75f11f1f1f175d2d5b275d2df2dbcc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2025-28012</id>
    <title> gnutls  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2025-11-25 00:00:00"/>
    <updated date="2025-11-25 00:00:00"/>
    <rights>Copyright 2025 Oracle, Inc.</rights>
    <description>[3.8.3-9_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35925409]
- Update FIPS module name for Oracle Linux [Orabug: 35925409]

[3.8.3-9]
- key_update: rework the rekeying logic (RHEL-107499)

[3.8.3-8]
- Add missing changelog entry

[3.8.3-7]
- Fix CVE-2025-32988, CVE-2025-32989, CVE-2025-32990, and CVE-2025-6395</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2025-28012.html" type="self" title="ELBA-2025-28012" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="gnutls-c++" version="3.8.3" release="9.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-c++-3.8.3-9.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">5090e3d4239ef9eaaaa8b7a982b2b85b3891fb65fe4fb4c0319708046f0b6a46</sum>
        </package>
        <package name="gnutls-utils" version="3.8.3" release="9.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-utils-3.8.3-9.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">86cc71823321c20bf3183330377088da2a385eac9492a21065104440302b3049</sum>
        </package>
        <package name="gnutls-devel" version="3.8.3" release="9.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-devel-3.8.3-9.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">e18e24d0ee8f39671cad7269c1c16a7b43b4e492dbc53d09f238cf09c5eeb1ee</sum>
        </package>
        <package name="gnutls" version="3.8.3" release="9.el9_fips" epoch="10" arch="src">
          <filename>gnutls-3.8.3-9.el9_fips.src.rpm</filename>
          <sum type="sha256">0fa702451ed9c17468d19600633496377447c7185b03974001a90e189c8ac3d2</sum>
        </package>
        <package name="gnutls" version="3.8.3" release="9.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-3.8.3-9.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">cd0b15f51caf867660fea931bb5e98592f7dc6772863a54732cb07e04894a894</sum>
        </package>
        <package name="gnutls-dane" version="3.8.3" release="9.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-dane-3.8.3-9.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">fc7619f9e855a7d7586b123a89e82c214540e0a5da1173aafed93b059b0e4440</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2025-28011</id>
    <title>openssl security update</title>
    <severity>Moderate</severity>
    <release>Oracle Linux 9</release>
    <issued date="2025-11-25 00:00:00"/>
    <updated date="2025-11-25 00:00:00"/>
    <rights>Copyright 2025 Oracle, Inc.</rights>
    <description>[3.5.1-4.0.2_fips]
- Update additional upstream references

[3.5.1-4.0.1_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name [Orabug: 35824276]

[3.5.1-4.0.1]
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]

[3.5.1.openela.0.1]
- Add OpenELA specific changes

[1:3.5.1-4]
- Fix CVE-2025-9230
  Resolves: RHEL-115929

[1:3.5.1-3]
- Add custom define to disable symbol versioning in downstream patched code
  Also add stricter Suggests for openssl-fips-provider
  Resolves: RHEL-104236
- Fix Requires/Provider to fix default install of fips providers
  Resolves: RHEL-104856

[1:3.5.1-2]
- Move fips.so to a seprate subpackage
  Reverts FIPS self test for SLH-DSA
  Add Suggests to try to prefer the openssl-fips-provider package
  over the fips-provider-next package by default
  Revolves: RHEL-102408
  Related: RHEL-80854

[1:3.5.1-1]
- Rebasing to OpenSSL 3.5.1
  Resolves: RHEL-97797
  Resolves: RHEL-98723
  Resolves: RHEL-99352

[1:3.5.0-4]
- Compact patches for better maintainability
  Related: RHEL-80854
- Make hybrid MLKEM work with our FIPS provider (3.0.7)
  Resolves: RHEL-95239

[1:3.5.0-3]
- Fix regressions caused by rebase to OpenSSL 3.5
  Related: RHEL-80854</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2025-28011.html" type="self" title="ELSA-2025-28011" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-9230.html" id="CVE-2025-9230" type="cve" title="CVE-2025-9230" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="openssl" version="3.5.1" release="4.0.2.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-3.5.1-4.0.2.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">a85e05cef4b16f106bfd94392513d893694bd50feb3ba630464d8092af7c4715</sum>
        </package>
        <package name="openssl-libs" version="3.5.1" release="4.0.2.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-libs-3.5.1-4.0.2.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">272bd91c4b027022d547d28747df0ce76872df4e13cbac293029f6b4146552e8</sum>
        </package>
        <package name="openssl-perl" version="3.5.1" release="4.0.2.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-perl-3.5.1-4.0.2.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">ff71ed899d7db65e1a51406e388a415e161f58cfc5e30a9323f62f992fb2eef5</sum>
        </package>
        <package name="openssl-devel" version="3.5.1" release="4.0.2.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-devel-3.5.1-4.0.2.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">47e31bcaa5017318338f799ee78de7e64c5dc66a68cef7f085b69dd9bb6ff512</sum>
        </package>
        <package name="openssl" version="3.5.1" release="4.0.2.el9_7_fips" epoch="10" arch="src">
          <filename>openssl-3.5.1-4.0.2.el9_7_fips.src.rpm</filename>
          <sum type="sha256">c8a1e62dfbef99393bbb0ec533af6d67aa96bf29daacc7c8029544301f182eac</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2026-50167</id>
    <title> nss  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2026-03-24 00:00:00"/>
    <updated date="2026-03-24 00:00:00"/>
    <rights>Copyright 2026 Oracle, Inc.</rights>
    <description>[3.112.0-8.el9_4_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35862190]
- Update FIPS module name for Oracle Linux [Orabug: 35862190]

[3.112.0-8]
- fix incomplete ml-kem pct patch.

[3.112.0-7]
- fix regression in -5 bug fix

[3.112.0-6]
- fix a null in ml-dsa pkcs12 decode
- fix return code in ml-kem pct

[3.112.0-5]
- fips update
-   Fix indicators for the new post-quantum algorithms
-   Fix the ML-KEM Self-tests
-   Fix the ML-KEM zeroizaiton
-   Add partial public validation before OAEP
- bug fixes
-   add CKA_SEED to private attributes so they are updated on password change.
-   mark CKA_PARAMETER_SET as CK_ULONG when storing into the database
-   fix unrefrence read in leancrypto.</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2026-50167.html" type="self" title="ELBA-2026-50167" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="nss-devel" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-devel-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">083ddf6d99375f4e40e5af4a5b620ea745c4dfbc25db029406656842fb9e65d2</sum>
        </package>
        <package name="nss-util-devel" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-util-devel-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">246b79636d9eda2fe2578c1a3769a4400d6110d4b5e624fde5927af34315c6ae</sum>
        </package>
        <package name="nss" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="src">
          <filename>nss-3.112.0-8.el9_4_fips.src.rpm</filename>
          <sum type="sha256">75c85906c2ee22abff973845dbadf4820ac840975ff0887b8f529f66d55c4a54</sum>
        </package>
        <package name="nss-pkcs11-devel" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-pkcs11-devel-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">687878c1354a02458c75512066174d2893eda2dfae9fb1dffe8622efa685c763</sum>
        </package>
        <package name="nss-tools" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-tools-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">fe41d4cccac00f141e08cedff2997e442f3af222e261671bfee6fd353aff30cf</sum>
        </package>
        <package name="nss-softokn" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">0ea6e51fcb5cc512b4dbfd33f5e19faf796b0863a6a16033c7a0623158a3985e</sum>
        </package>
        <package name="nss-softokn-freebl-devel" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-devel-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">4fc476d1bdb4b278fb5afcf6e41d28b6fdce3d04475226461e52f80d59a75cdd</sum>
        </package>
        <package name="nspr-devel" version="4.36.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nspr-devel-4.36.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">480e0d15a2f0d74ea9b87cce9411bb100933449cee74c1018fc3100f58ce5364</sum>
        </package>
        <package name="nspr" version="4.36.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nspr-4.36.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">a0813c45a4b05a95a626a171e6b59ceef43f32a25f9ad4a865d1e1443ac86101</sum>
        </package>
        <package name="nss" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">8512a31ace1406580296c6788919f9b833faf0b4325df6f541183a990ecc510d</sum>
        </package>
        <package name="nss-softokn-devel" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-devel-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">85f5fbb5c945420f65179e08246edf411e6a64de5b3a8ca57e206cbd0a4cc543</sum>
        </package>
        <package name="nss-util" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-util-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">7b5fa4257b008a7108608ad2988ef13a3295290118ad7f20761af8b29bf704ad</sum>
        </package>
        <package name="nss-sysinit" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-sysinit-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">35f3d5af00ae7f7fb7a3145b3aea4968b8ca25adb3cd49b73798fe9f555347d7</sum>
        </package>
        <package name="nss-softokn-freebl" version="3.112.0" release="8.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-3.112.0-8.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">a2f6817a4df25bfb868c0634461303252d2302bc9fb424966b77a9108ad69b12</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2025-20557</id>
    <title> nss  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2025-09-09 00:00:00"/>
    <updated date="2025-09-09 00:00:00"/>
    <rights>Copyright 2025 Oracle, Inc.</rights>
    <description>[3.112.0-4.el9_4_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35862190]
- Update FIPS module name for Oracle Linux [Orabug: 35862190]

[3.112.0-4]
- fix interface issue when pulling 3.0 pkcs#11 interfaces explicitly

[3.112.0-3]
- restore CONCATENATE functions accidentally remvoed in the last patch
- fix big endian issue in tstclnt and selfserv in certificate compression

[3.112.0-2]
- add fips required changes.
- fix bugs found by QE

[3.112.0-1]
- rebase to NSS 3.112
- add ml-kem-1024 support
- add ml-dsa support</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2025-20557.html" type="self" title="ELBA-2025-20557" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="nspr" version="4.36.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nspr-4.36.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">0ca6a9e7c5183a8775e71e45962d668f8e64e04c418607a622811bd8359a07b7</sum>
        </package>
        <package name="nss-sysinit" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-sysinit-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">205702a202b87d360973b3b09dc653d2704e9a620105941b66ff6be1f0c7e5c2</sum>
        </package>
        <package name="nss" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="src">
          <filename>nss-3.112.0-4.el9_4_fips.src.rpm</filename>
          <sum type="sha256">2147efd986c6ea1ba1c38d3bf2c4f436595e9d28d1b1c062da3a8408ad82eafd</sum>
        </package>
        <package name="nss-softokn" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">8c18be417bdfd38bacea9f2d4be29d4b44d8b4d132483b8ccd96a848ec3fc53a</sum>
        </package>
        <package name="nss" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">c7ee8e0ffdfed56d1d318ba8390854fa000ff8affb3930a3d164bb6127220149</sum>
        </package>
        <package name="nss-util" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-util-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">cf2134418a18c5d050ceae90a143091ad742fe17785d37324f9822bd6ab244b8</sum>
        </package>
        <package name="nss-softokn-devel" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-devel-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">714dc52424013c6d568cdc9ef74eafb0abd04ad379d2ced38fadb3fa870a735e</sum>
        </package>
        <package name="nss-util-devel" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-util-devel-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">d02cd20027b5de835b7212434760056ad9c2495698b2af8f212997aff9ef6bf6</sum>
        </package>
        <package name="nss-pkcs11-devel" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-pkcs11-devel-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">75f8e12d4c44a191e8fe1018d102f25412c2181ec72feaa3107b0316ad6a8eee</sum>
        </package>
        <package name="nss-devel" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-devel-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">3567d37fbb630b4915b14f48f2ef612b035b20a8d67d355cddcc45aecbe52ae1</sum>
        </package>
        <package name="nss-softokn-freebl-devel" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-devel-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">fb78890fc3a83b64a36b3ef45f812c11ed151604c6c812a6bcccb9582ef52af3</sum>
        </package>
        <package name="nss-tools" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-tools-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">164f65d3d36b998ca5f728837a7c7adac81ccdf34ae9fdeb211a7c7901aa57e3</sum>
        </package>
        <package name="nspr-devel" version="4.36.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nspr-devel-4.36.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">aaaa859a4f891054d2844b5d8063d6ffe4ba720d114c3fd5bde6f4b9e0c8b38f</sum>
        </package>
        <package name="nss-softokn-freebl" version="3.112.0" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-3.112.0-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">25435111b66a78ffe15de98bc933ff17a002fa0fdff31bbf273bec219cde5128</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2024-12833</id>
    <title> openssl  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2024-11-21 00:00:00"/>
    <updated date="2024-11-21 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[1:3.2.2-6.0.1_fips]
- Replace upstream references in fips man pages [Orabug: 35824276]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name and remove upstream references from
  fips_module_indicators manpage [Orabug: 35824276]

[1:3.2.2-6.0.1]
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]

[1:3.2.2-6]
- rebuilt
  Related: RHEL-55339

[1:3.2.2-5]
- Fix CVE-2024-6119: Possible denial of service in X.509 name checks
  Resolves: RHEL-55339

[1:3.2.2-4]
- Fix CVE-2024-5535: SSL_select_next_proto buffer overread
  Resolves: RHEL-45657

[1:3.2.2-3]
- Replace HKDF backward compatibility patch with the official one
  Related: RHEL-40823

[1:3.2.2-2]
- Add workaround for EVP_PKEY_CTX_add1_hkdf_info with older providers
  Resolves: RHEL-40823

[1:3.2.2-1]
- Rebase to OpenSSL 3.2.2. Fixes CVE-2024-2511, CVE-2024-4603, CVE-2024-4741,
  and Minerva attack.
  Resolves: RHEL-32148
  Resolves: RHEL-36792
  Resolves: RHEL-38514
  Resolves: RHEL-39111

[1:3.2.1-2]
- Update RNG changing for FIPS purpose
  Resolves: RHEL-35380

[1:3.2.1-1]
- Rebasing OpenSSL to 3.2.1
  Resolves: RHEL-26271</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2024-12833.html" type="self" title="ELBA-2024-12833" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="openssl-libs" version="3.2.2" release="6.0.1.el9_5_fips" epoch="10" arch="aarch64">
          <filename>openssl-libs-3.2.2-6.0.1.el9_5_fips.aarch64.rpm</filename>
          <sum type="sha256">c05d5ecdad334598fd02ae3ae32559ac7c06cd40b306aa2dd174d7f6c3bf43cd</sum>
        </package>
        <package name="openssl" version="3.2.2" release="6.0.1.el9_5_fips" epoch="10" arch="aarch64">
          <filename>openssl-3.2.2-6.0.1.el9_5_fips.aarch64.rpm</filename>
          <sum type="sha256">1033d59ffb59bc4037a679f1e1e9f24c147eeed0409df62b8506f906d8d81963</sum>
        </package>
        <package name="openssl-perl" version="3.2.2" release="6.0.1.el9_5_fips" epoch="10" arch="aarch64">
          <filename>openssl-perl-3.2.2-6.0.1.el9_5_fips.aarch64.rpm</filename>
          <sum type="sha256">327918d12e22d48f0b1f4f79df488cc72dcff77be77d67426b29545adf04f1ea</sum>
        </package>
        <package name="openssl" version="3.2.2" release="6.0.1.el9_5_fips" epoch="10" arch="src">
          <filename>openssl-3.2.2-6.0.1.el9_5_fips.src.rpm</filename>
          <sum type="sha256">1e06db990efd4aa561070f01b09daf6bc151ca3f224391d9e4534ac35226be7e</sum>
        </package>
        <package name="openssl-devel" version="3.2.2" release="6.0.1.el9_5_fips" epoch="10" arch="aarch64">
          <filename>openssl-devel-3.2.2-6.0.1.el9_5_fips.aarch64.rpm</filename>
          <sum type="sha256">4e84638f4ad7bad672d06335427a40a95a7da9bd513d7b1a8c311e911e69e12a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2024-12365</id>
    <title> openssl  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2024-05-08 00:00:00"/>
    <updated date="2024-05-08 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[1:3.0.7-27.0.3_fips]
- Replace upstream references in fips man pages [Orabug: 35824276]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name and remove upstream references from
  fips_module_indicators manpage [Orabug: 35824276]

[1:3.0.7-27.0.3]
- Enable openssl-fips-provider dependency [Orabug: 36504822]

[1:3.0.7-27.0.2]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]

[1:3.0.7-27.0.1]
- Replace upstream references [Orabug: 34340177]

[1:3.0.7-27]
- Use certified FIPS module instead of freshly built one in Red Hat distribution
  Related: RHEL-23474

[1:3.0.7-26]
- Avoid implicit function declaration when building openssl
  Related: RHEL-1780
- In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails
  Resolves: RHEL-17104
- Add a directory for OpenSSL providers configuration
  Resolves: RHEL-17193
- Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context
  Resolves: RHEL-19515
- POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)
  Resolves: RHEL-21151
- Excessive time spent checking invalid RSA public keys (CVE-2023-6237)
  Resolves: RHEL-21654
- SSL ECDHE Kex fails when pkcs11 engine is set in config file
  Resolves: RHEL-20249
- Denial of service via null dereference in PKCS#12
  Resolves: RHEL-22486
- Use certified FIPS module instead of freshly built one in Red Hat distribution
  Resolves: RHEL-23474</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2024-12365.html" type="self" title="ELBA-2024-12365" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="openssl" version="3.0.7" release="27.0.3.el9_fips" epoch="10" arch="aarch64">
          <filename>openssl-3.0.7-27.0.3.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">2239ebd512e105292cfd78c33c8a130619bbd5f23030362c075c6c1a553c4d81</sum>
        </package>
        <package name="openssl-perl" version="3.0.7" release="27.0.3.el9_fips" epoch="10" arch="aarch64">
          <filename>openssl-perl-3.0.7-27.0.3.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">8700b5e0cac546da44d6fdfa7d9e9e456df2029b9600c3b427afae7172ae8ed2</sum>
        </package>
        <package name="openssl-devel" version="3.0.7" release="27.0.3.el9_fips" epoch="10" arch="aarch64">
          <filename>openssl-devel-3.0.7-27.0.3.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">1cc819c1e815652dda3776d853f889ea61f8d0438f65143a6dab48ea550480a3</sum>
        </package>
        <package name="openssl-libs" version="3.0.7" release="27.0.3.el9_fips" epoch="10" arch="aarch64">
          <filename>openssl-libs-3.0.7-27.0.3.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">7033647405c3bcbdcc52c266cf128183edf4f9a66b3b61fd52c7310b105915d7</sum>
        </package>
        <package name="openssl" version="3.0.7" release="27.0.3.el9_fips" epoch="10" arch="src">
          <filename>openssl-3.0.7-27.0.3.el9_fips.src.rpm</filename>
          <sum type="sha256">1357e1d5b86740f3f4d72e73feaad2ef582c11a457cd632fbbf11aa4f55f185c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2024-12366</id>
    <title> nss  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2024-05-08 00:00:00"/>
    <updated date="2024-05-08 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[3.90.0-7.el9_4_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35862190]
- Update FIPS module name for Oracle Linux [Orabug: 35862190]</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2024-12366.html" type="self" title="ELBA-2024-12366" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="nss-sysinit" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-sysinit-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">f543a4d9c6d771c8b182e4db63a8c40524f8ac106c7e5da841caff85bff647c5</sum>
        </package>
        <package name="nss" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="src">
          <filename>nss-3.90.0-7.el9_4_fips.src.rpm</filename>
          <sum type="sha256">f7e6e1b5d62de4b6018ba26a967c54fb08c9acd5d4bf7969636d4b4d9064d276</sum>
        </package>
        <package name="nspr-devel" version="4.35.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nspr-devel-4.35.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">a304d8ae652f446e7458a26123ffa6b70183244774b8ed59d34166f39173c1c3</sum>
        </package>
        <package name="nss-util" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-util-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">b82a5ad9f396a851a326d62a50a1eb34bcd4fdba4b079d408a589b689493f6dd</sum>
        </package>
        <package name="nss-softokn" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">2a53694939927f01b1d9bcbdd84ef477c6ed5f335635c39c88a279f290d51de0</sum>
        </package>
        <package name="nss-softokn-freebl-devel" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-devel-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">08620552647773912b61488969ef6c179236de2ad52a67439bc4b735521166d5</sum>
        </package>
        <package name="nss-tools" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-tools-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">008bcbd39e37e34d295fc93da47deb7839bd80e804f191bd69f1cbfc5059b65e</sum>
        </package>
        <package name="nss" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">712720491a5f1f5b7e4011642c78d5325dc5a3b0fa79821df11460c7a6ce6f07</sum>
        </package>
        <package name="nspr" version="4.35.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nspr-4.35.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">2008a04c14cf331d4a395b0dfc22c864ca04b7f79c9370539088545f1194a68b</sum>
        </package>
        <package name="nss-softokn-freebl" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">19053a3bbc87ede217d007fef2722259a035b3102abf4d2be80d916c7d1150cb</sum>
        </package>
        <package name="nss-util-devel" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-util-devel-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">3796598c74a8025af49ca2108765edc980dfd2f2cf8e06baf264f9a3d8086066</sum>
        </package>
        <package name="nss-softokn-devel" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-devel-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">414bb34ea54cf2d369560ee7a7c0514f4337e29e26839745e0baa626b7b3b786</sum>
        </package>
        <package name="nss-pkcs11-devel" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-pkcs11-devel-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">b66b0429cf3db6b2bf6306e3cbbacd94877b8c076409103392a1ca348326d24e</sum>
        </package>
        <package name="nss-devel" version="3.90.0" release="7.el9_4_fips" epoch="10" arch="aarch64">
          <filename>nss-devel-3.90.0-7.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">99b12d75d44bf5534696ec9cb90ba269c20211f8b20583c3b860365fb4782418</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2024-12364</id>
    <title>gnutls security update</title>
    <severity>Moderate</severity>
    <release>Oracle Linux 9</release>
    <issued date="2024-05-08 00:00:00"/>
    <updated date="2024-05-08 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[3.8.3-4_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35925409]
- Update FIPS module name for Oracle Linux [Orabug: 35925409]

[3.8.3-4]
- Bump release to ensure el9 package is greater than el9_* packages

[3.8.3-3]
- Bump release to ensure el9 package is greater than el9_* packages

[3.8.3-2]
- Fix timing side-channel in deterministic ECDSA (RHEL-28959)
- Fix potential crash during chain building/verification (RHEL-28954)

[3.8.3-1]
- Update to gnutls 3.8.3 (RHEL-14891)

[3.8.2-3]
- Skip KTLS test exercising ChaCha20-Poly1305 in TLS 1.3 as well (RHEL-18498)

[3.8.2-2]
- Bump nettle dependency to 3.9.1
- Skip KTLS test exercising ChaCha20-Poly1305 in TLS 1.2 (RHEL-18498)

[3.8.2-1]
- Update to gnutls 3.8.2 (RHEL-14891)</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2024-12364.html" type="self" title="ELSA-2024-12364" />
      <reference href="https://linux.oracle.com/cve/CVE-2024-28834.html" id="CVE-2024-28834" type="cve" title="CVE-2024-28834" />
      <reference href="https://linux.oracle.com/cve/CVE-2024-28835.html" id="CVE-2024-28835" type="cve" title="CVE-2024-28835" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="gnutls-devel" version="3.8.3" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-devel-3.8.3-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">722aecbb74ac175528d19312ac0bbc1620c2d45afe08cef62860591edd27e3a6</sum>
        </package>
        <package name="gnutls-dane" version="3.8.3" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-dane-3.8.3-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">ef3fdf97a12d967b3a1e4eb1b701660c0e63516b3e8d9c4a3d311bcb65a427e9</sum>
        </package>
        <package name="gnutls-c++" version="3.8.3" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-c++-3.8.3-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">e3f09f09125b4641ea9b5d3299d22db131a82824612b7d3054b1a28b96ccf9fb</sum>
        </package>
        <package name="gnutls" version="3.8.3" release="4.el9_4_fips" epoch="10" arch="src">
          <filename>gnutls-3.8.3-4.el9_4_fips.src.rpm</filename>
          <sum type="sha256">cbf2c088b94322ddf6b322b9200b4d805cdcd6f2993b6467fcb95b95a510fb09</sum>
        </package>
        <package name="gnutls-utils" version="3.8.3" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-utils-3.8.3-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">da64f860f50c62714ecfc9b74c487d9a09f9a13a80eea0f1ded4e85048536608</sum>
        </package>
        <package name="gnutls" version="3.8.3" release="4.el9_4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-3.8.3-4.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">6e86d696028a27d0bfd2f184514a0eff6ea86f4d6a5f84fe160d573478da47db</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2024-12212</id>
    <title> FIPS140-3 Certification</title>
    <release>Oracle Linux 9</release>
    <issued date="2024-03-13 00:00:00"/>
    <updated date="2024-03-13 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>kernel-uek
[5.15.0-101.103.2.1]
- Revert 'attr: use consistent sgid stripping checks' (Sherry Yang)  [Orabug: 35346968] 
- Revert 'iommu: Force iommu shutdown on panic' (Boris Ostrovsky)  [Orabug: 35346963]

[5.15.0-101.103.2]
- uek-rpm: mod-extra: Remove mt7921e.ko from extras list (Harshit Mogalapalli)  [Orabug: 34999685] 
- crypto: allow ECDH and ECDSA algorithms in FIPS (Saeed Mirzamohammadi)  [Orabug: 35230211] 
- uek-rpm: make CRYPTO_ECDSA builtin (Saeed Mirzamohammadi)  [Orabug: 35230211] 
- KVM: arm64: PMU: Align chained counter implementation with architecture pseudocode (Marc Zyngier)  [Orabug: 35243389] 
- net/mlx5: Fix memory leak in error flow of port set buffer (Maher Sanalla)  [Orabug: 35246355] 
- net/mlx5e: Update shared buffer along with device buffer changes (Maher Sanalla)  [Orabug: 35246355] 
- net/mlx5e: Add API to query/modify SBPR and SBCM registers (Maher Sanalla)  [Orabug: 35246355] 
- net/mlx5: Expose shared buffer registers bits and structs (Maher Sanalla)  [Orabug: 35246355] 
- PCI: Work around Intel I210 ROM BAR overlap defect (Bjorn Helgaas)  [Orabug: 35250975] 
- net/rds: Adding TCP stats for TCP keepalive timeout (Nagappan Ramasamy Palaniappan)  [Orabug: 35254377] 
- rds: slight code cleanup of RDS checksum code (William Kucharski)  [Orabug: 35262486] 
- x86/acpi/boot: Correct acpi_is_processor_usable() check (Eric DeVolder)  [Orabug: 35274587] 
- x86/ACPI/boot: Use FADT version to check support for online capable (Mario Limonciello)  [Orabug: 35274587] 
- x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC (Kishon Vijay Abraham I)  [Orabug: 35274587] 
- x86/ACPI: Don't add CPUs that are not online capable (Mario Limonciello)  [Orabug: 35274587] 
- ACPICA: Add support for MADT online enabled bit (Mario Limonciello)  [Orabug: 35274587] 
- net/rds: use appropriate reason while dropping a connection (Praveen Kumar Kannoju)  [Orabug: 35278121] 
- KVM: nVMX: add missing consistency checks for CR0 and CR4 (Paolo Bonzini)  [Orabug: 35278210]  {CVE-2023-30456}
- Revert 'scsi: megaraid_sas: Skip syncing the RAID map on older controllers' (Sherry Yang)  [Orabug: 35285941]

[5.15.0-101.103.1]
- Revert 'Revert 'x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments'' (Tom Saeger)  
- Revert 'Revert 'Makefile: link with -z noexecstack --no-warn-rwx-segments'' (Tom Saeger)  
- LTS version: v5.15.103 (Jack Vogel)  
- Makefile: use -gdwarf-{4|5} for assembler for DEBUG_INFO_DWARF{4|5} (Nick Desaulniers)  
- KVM: VMX: Fix crash due to uninitialized current_vmcs (Alexandru Matei)  
- KVM: VMX: Introduce vmx_msr_bitmap_l01_changed() helper (Vitaly Kuznetsov)  
- KVM: nVMX: Don't use Enlightened MSR Bitmap for L3 (Vitaly Kuznetsov)  
- fs: hold writers when changing mount's idmapping (Christian Brauner)  
- UML: define RUNTIME_DISCARD_EXIT (Masahiro Yamada)  
- xfs: remove xfs_setattr_time() declaration (Gaosheng Cui)  
- KVM: fix memoryleak in kvm_init() (Miaohe Lin)  
- tools bpftool: Fix compilation error with new binutils (Andres Freund)  
- tools bpf_jit_disasm: Fix compilation error with new binutils (Andres Freund)  
- tools perf: Fix compilation error with new binutils (Andres Freund)  
- tools include: add dis-asm-compat.h to handle version differences (Andres Freund)  
- tools build: Add feature test for init_disassemble_info API changes (Andres Freund)  
- sh: define RUNTIME_DISCARD_EXIT (Tom Saeger)  
- s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld &lt; 2.36 (Masahiro Yamada)  
- powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds (Michael Ellerman)  
- powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT (Michael Ellerman)  
- arch: fix broken BuildID for arm64 and riscv (Masahiro Yamada)  
- ext4: block range must be validated before use in ext4_mb_clear_bb() (Lukas Czerner)  
- ext4: add strict range checks while freeing blocks (Ritesh Harjani)  
- ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid() (Ritesh Harjani)  
- ext4: refactor ext4_free_blocks() to pull out ext4_mb_clear_bb() (Ritesh Harjani)  
- filelocks: use mount idmapping for setlease permission check (Seth Forshee)  
- media: rc: gpio-ir-recv: add remove function (Li Jun)  
- media: ov5640: Fix analogue gain control (Paul Elder)  
- scripts: handle BrokenPipeError for python scripts (Masahiro Yamada)  
- PCI: Add SolidRun vendor ID (Alvaro Karsz)  
- macintosh: windfarm: Use unsigned type for 1-bit bitfields (Nathan Chancellor)  
- alpha: fix R_ALPHA_LITERAL reloc for large modules (Edward Humes)  
- powerpc/kcsan: Exclude udelay to prevent recursive instrumentation (Rohan McLure)  
- powerpc/iommu: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- MIPS: Fix a compilation issue (xurui)  
- fs: use consistent setgid checks in is_sxid() (Christian Brauner)  
- attr: use consistent sgid stripping checks (Christian Brauner)  
- attr: add setattr_should_drop_sgid() (Christian Brauner)  
- fs: move should_remove_suid() (Christian Brauner)  
- attr: add in_group_or_capable() (Christian Brauner)  
- fs: move S_ISGID stripping into the vfs_*() helpers (Yang Xu)  
- fs: add mode_strip_sgid() helper (Yang Xu)  
- xfs: set prealloc flag in xfs_alloc_file_space() (Dave Chinner)  
- xfs: fallocate() should call file_modified() (Dave Chinner)  
- xfs: remove XFS_PREALLOC_SYNC (Dave Chinner)  
- xfs: use setattr_copy to set vfs inode attributes (Darrick J. Wong)  
- tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address (Morten Linderud)  
- watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths (David Disseldorp)  
- staging: rtl8723bs: Fix key-store index handling (Hans de Goede)  
- staging: rtl8723bs: fix placement of braces (Hannes Braun)  
- Staging: rtl8723bs: Placing opening { braces in previous line (Jagath Jog J)  
- staging: rtl8723bs: clean up comparsions to NULL (Michael Straube)  
- iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (Gavrilov Ilia)  
- iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options (Kim Phillips)  
- iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands (Suravee Suthikulpanit)  
- nbd: use the correct block_device in nbd_bdev_reset (Christoph Hellwig)  
- irqdomain: Fix mapping-creation race (Johan Hovold)  
- ext4: Fix deadlock during directory rename (Jan Kara)  
- RISC-V: Don't check text_mutex during stop_machine (Conor Dooley)  
- s390/ftrace: remove dead code (Heiko Carstens)  
- riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode (Alexandre Ghiti)  
- af_unix: fix struct pid leaks in OOB support (Eric Dumazet)  
- af_unix: Remove unnecessary brackets around CONFIG_AF_UNIX_OOB. (Kuniyuki Iwashima)  
- net: dsa: mt7530: permit port 5 to work without port 6 on MT7621 SoC (Vladimir Oltean)  
- SUNRPC: Fix a server shutdown leak (Benjamin Coddington)  
- octeontx2-af: Unlock contexts in the queue context cache in case of fault detection (Suman Ghosh)  
- net/smc: fix fallback failed while sendmsg with fastopen (D. Wythe)  
- platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it (Randy Dunlap)  
- netfilter: conntrack: adopt safer max chain length (Eric Dumazet)  
- scsi: megaraid_sas: Update max supported LD IDs to 240 (Chandrakanth Patil)  
- net: ethernet: mtk_eth_soc: fix RX data corruption issue (Daniel Golle)  
- net: phy: smsc: fix link up detection in forced irq mode (Heiner Kallweit)  
- net: phy: smsc: Cache interrupt mask (Lukas Wunner)  
- btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR (Lorenz Bauer)  
- netfilter: tproxy: fix deadlock due to missing BH disable (Florian Westphal)  
- netfilter: ctnetlink: revert to dumping mark regardless of event type (Ivan Delalande)  
- bnxt_en: Avoid order-5 memory allocation for TPA data (Michael Chan)  
- net: phylib: get rid of unnecessary locking (Russell King (Oracle))  
- net: stmmac: add to set device wake up flag when stmmac init phy (Rongguang Wei)  
- drm/msm/dpu: fix len of sc7180 ctl blocks (Dmitry Baryshkov)  
- bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() (Liu Jian)  
- ice: copy last block omitted in ice_get_module_eeprom() (Petr Oros)  
- net: caif: Fix use-after-free in cfusbl_device_notify() (Shigeru Yoshida)  
- net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver (Yuiko Oshino)  
- perf stat: Fix counting when initial delay configured (Changbin Du)  
- selftests: nft_nat: ensuring the listening side is up before starting the client (Hangbin Liu)  
- ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (Eric Dumazet)  
- powerpc: dts: t1040rdb: fix compatible string for Rev A boards (Vladimir Oltean)  
- nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties (Kang Chen)  
- bgmac: fix *initial* chip reset to support BCM5358 (Rafal Milecki)  
- drm/msm/a5xx: fix context faults during ring switch (Dmitry Baryshkov)  
- drm/msm/a5xx: fix the emptyness check in the preempt code (Dmitry Baryshkov)  
- drm/msm/a5xx: fix highest bank bit for a530 (Dmitry Baryshkov)  
- drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register (Dmitry Baryshkov)  
- drm/msm: Fix potential invalid ptr free (Rob Clark)  
- drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype (Jiri Slaby (SUSE))  
- drm/nouveau/kms/nv50-: remove unused functions (Ben Skeggs)  
- ext4: Fix possible corruption when moving a directory (Jan Kara)  
- regulator: core: Use ktime_get_boottime() to determine how long a regulator was off (Matthias Kaehlcke)  
- regulator: core: Fix off-on-delay-us for always-on/boot-on regulators (Christian Kohlschutter)  
- regulator: Flag uncontrollable regulators as always_on (Mark Brown)  
- scsi: core: Remove the /proc/scsi/ directory earlier (Bart Van Assche)  
- riscv: Add header include guards to insn.h (Liao Chang)  
- riscv: Avoid enabling interrupts in die() (Mattias Nissler)  
- RISC-V: Avoid dereferening NULL regs in die() (Palmer Dabbelt)  
- arm64: efi: Make efi_rt_lock a raw_spinlock (Pierre Gondois)  
- brd: mark as nowait compatible (Jens Axboe)  
- block/brd: add error handling support for add_disk() (Luis Chamberlain)  
- iommu/vt-d: Fix PASID directory pointer coherency (Jacob Pan)  
- irqdomain: Refactor __irq_domain_alloc_irqs() (Johan Hovold)  
- f2fs: retry to update the inode page given data corruption (Jaegeuk Kim)  
- f2fs: do not bother checkpoint by f2fs_get_node_info (Jaegeuk Kim)  
- f2fs: avoid down_write on nat_tree_lock during checkpoint (Jaegeuk Kim)  
- udf: Fix off-by-one error when discarding preallocation (Jan Kara)  
- fs: dlm: start midcomms before scand (Alexander Aring)  
- fs: dlm: add midcomms init/start functions (Alexander Aring)  
- fs: dlm: fix log of lowcomms vs midcomms (Alexander Aring)  
- KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target (Sean Christopherson)  
- KVM: SVM: Don't rewrite guest ICR on AVIC IPI virtualization failure (Sean Christopherson)  
- KVM: Register /dev/kvm as the _very_ last thing during initialization (Sean Christopherson)  
- KVM: Pre-allocate cpumasks for kvm_make_all_cpus_request_except() (Vitaly Kuznetsov)  
- KVM: Optimize kvm_make_vcpus_request_mask() a bit (Vitaly Kuznetsov)  
- nfc: change order inside nfc_se_io error path (Fedor Pchelkin)  
- ext4: zero i_disksize when initializing the bootloader inode (Zhihao Cheng)  
- ext4: fix WARNING in ext4_update_inline_data (Ye Bin)  
- ext4: move where set the MAY_INLINE_DATA flag is set (Ye Bin)  
- ext4: fix another off-by-one fsmap error on 1k block filesystems (Darrick J. Wong)  
- ext4: fix RENAME_WHITEOUT handling for inline directories (Eric Whitney)  
- ext4: fix cgroup writeback accounting with fs-layer encryption (Eric Biggers)  
- staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss() (Hans de Goede)  
- drm/connector: print max_requested_bpc in state debugfs (Harry Wentland)  
- drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15 (Alex Deucher)  
- x86/CPU/AMD: Disable XSAVES on AMD family 0x17 (Andrew Cooper)  
- fork: allow CLONE_NEWTIME in clone3 flags (Tobias Klauser)  
- perf inject: Fix --buildid-all not to eat up MMAP2 (Namhyung Kim)  
- btrfs: fix percent calculation for bg reclaim message (Johannes Thumshirn)  
- LTS version: v5.15.102 (Jack Vogel)  
- staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh (Philipp Hortmann)  
- staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script (Philipp Hortmann)  
- wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext' (Hector Martin)  
- LTS version: v5.15.101 (Jack Vogel)  
- Revert 'drm/i915: Don't use BAR mappings for ring buffers with LLC' (Greg Kroah-Hartman)  
- LTS version: v5.15.100 (Jack Vogel)  
- usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails (Yang Yingliang)  
- malidp: Fix NULL vs IS_ERR() checking (Miaoqian Lin)  
- scsi: mpt3sas: Remove usage of dma_get_required_mask() API (Sreekanth Reddy)  
- scsi: mpt3sas: re-do lost mpt3sas DMA mask fix (Sreekanth Reddy)  
- scsi: mpt3sas: Don't change DMA mask while reallocating pools (Sreekanth Reddy)  
- Revert 'scsi: mpt3sas: Fix return value check of dma_get_required_mask()' (Salvatore Bonaccorso)  
- drm/virtio: Fix error code in virtio_gpu_object_shmem_init() (Harshit Mogalapalli)  
- media: uvcvideo: Fix race condition with usb_kill_urb (Ricardo Ribalda)  
- Bluetooth: hci_sock: purge socket queues in the destruct() callback (Nguyen Dinh Phi)  
- drm/display/dp_mst: Fix down message handling after a packet reception error (Imre Deak)  
- drm/display/dp_mst: Fix down/up message handling after sink disconnect (Imre Deak)  
- x86/resctl: fix scheduler confusion with 'current' (Linus Torvalds)  
- net: tls: avoid hanging tasks on the tx_lock (Jakub Kicinski)  
- soundwire: cadence: Drain the RX FIFO after an IO timeout (Richard Fitzgerald)  
- soundwire: cadence: Remove wasted space in response_buf (Richard Fitzgerald)  
- phy: rockchip-typec: Fix unsigned comparison with less than zero (Jiapeng Chong)  
- PCI: Add ACS quirk for Wangxun NICs (Mengyuan Lou)  
- PCI: loongson: Add more devices that need MRRS quirk (Huacai Chen)  
- kernel/fail_function: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- drivers: base: dd: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- drivers: base: component: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- misc: vmw_balloon: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- tty: pcn_uart: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- PCI: Take other bus devices into account when distributing resources (Mika Westerberg)  
- PCI: Align extra resources for hotplug bridges properly (Mika Westerberg)  
- usb: gadget: uvc: Make bSourceID read/write (Daniel Scally)  
- usb: uvc: Enumerate valid values for color matching (Daniel Scally)  
- USB: ene_usb6250: Allocate enough memory for full object (Kees Cook)  
- usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math (Kees Cook)  
- USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: gadget: gr_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: isp1362: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: isp116x: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: fotg210: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: sl811: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: uhci: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: chipidea: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: dwc3: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- PCI: loongson: Prevent LS7A MRRS increases (Huacai Chen)  
- soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe() (Richard Fitzgerald)  
- iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() (Harshit Mogalapalli)  
- iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() (Harshit Mogalapalli)  
- tools/iio/iio_utils:fix memory leak (Yulong Zhang)  
- mei: bus-fixup:upon error print return values of send and receive (Alexander Usyskin)  
- serial: sc16is7xx: setup GPIO controller later in probe (Isaac True)  
- tty: serial: fsl_lpuart: disable the CTS when send break signal (Sherry Sun)  
- tty: fix out-of-bounds access in tty_driver_lookup_tty() (Sven Schnelle)  
- staging: emxx_udc: Add checks for dma_alloc_coherent() (Yuan Can)  
- USB: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- media: uvcvideo: Silence memcpy() run-time false positive warnings (Kees Cook)  
- media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 (Ricardo Ribalda)  
- media: uvcvideo: Handle errors from calls to usb_string (Guenter Roeck)  
- media: uvcvideo: Handle cameras with invalid descriptors (Ricardo Ribalda)  
- media: uvcvideo: Remove format descriptions (Laurent Pinchart)  
- iommu/amd: Fix error handling for pdev_pri_ats_enable() (Vasant Hegde)  
- IB/hfi1: Update RMT size calculation (Dean Luick)  
- mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak (Liang He)  
- bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support (Souradeep Chowdhury)  
- firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 (Darrell Kavanagh)  
- kernel/printk/index.c: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- tracing: Add NULL checks for buffer in ring_buffer_free_read_page() (Jia-Ju Bai)  
- thermal: intel: BXT_PMIC: select REGMAP instead of depending on it (Randy Dunlap)  
- thermal: intel: quark_dts: fix error pointer dereference (Dan Carpenter)  
- ASoC: mediatek: mt8195: add missing initialization (Trevor Wu)  
- ASoC: zl38060 add gpiolib dependency (Arnd Bergmann)  
- ASoC: zl38060: Remove spurious gpiolib select (Mark Brown)  
- ASoC: adau7118: don't disable regulators on device unbind (Nuno Sa)  
- loop: loop_set_status_from_info() check before assignment (Zhong Jinghua)  
- rtc: allow rtc_read_alarm without read_alarm callback (Alexandre Belloni)  
- scsi: ipr: Work around fortify-string warning (Arnd Bergmann)  
- genirq: Add and use an irq_data_update_affinity helper (Samuel Holland)  
- genirq: Refactor accessors to use irq_data_get_affinity_mask (Samuel Holland)  
- rtc: sun6i: Always export the internal oscillator (Samuel Holland)  
- vc_screen: modify vcs_size() handling in vcs_read() (George Kennedy)  
- tcp: tcp_check_req() can be called from process context (Eric Dumazet)  
- ARM: dts: spear320-hmi: correct STMPE GPIO compatible (Krzysztof Kozlowski)  
- net/sched: act_sample: fix action bind logic (Pedro Tammela)  
- net/sched: act_mpls: fix action bind logic (Pedro Tammela)  
- net/sched: act_pedit: fix action bind logic (Pedro Tammela)  
- net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela)  
- nfc: fix memory leak of se_io context in nfc_genl_se_io (Fedor Pchelkin)  
- net/mlx5: Geneve, Fix handling of Geneve object id as error code (Maor Dickman)  
- net/mlx5e: Verify flow_source cap before using it (Roi Dayan)  
- 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() (Zhengchao Shao)  
- 9p/xen: fix connection sequence (Juergen Gross)  
- 9p/xen: fix version parsing (Juergen Gross)  
- net: fix __dev_kfree_skb_any() vs drop monitor (Eric Dumazet)  
- octeontx2-pf: Use correct struct reference in test condition (Deepak R Varma)  
- sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (Xin Long)  
- ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (Lu Wei)  
- netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (Pavel Tikhomirov)  
- netfilter: ebtables: fix table blob use-after-free (Florian Westphal)  
- netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Hangyu Hua)  
- watchdog: sbsa_wdog: Make sure the timeout programming is within the limits (George Cherian)  
- watchdog: pcwd_usb: Fix attempting to access uninitialized memory (Li Hua)  
- watchdog: Fix kmemleak in watchdog_cdev_register (Chen Jun)  
- watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path (ruanjinjie)  
- um: virt-pci: properly remove PCI device from bus (Benjamin Berg)  
- um: virtio_uml: move device breaking into workqueue (Benjamin Berg)  
- um: virtio_uml: mark device as unregistered when breaking it (Benjamin Berg)  
- um: virtio_uml: free command if adding to virtqueue failed (Benjamin Berg)  
- x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list (Ammar Faizi)  
- netfilter: nf_tables: allow to fetch set elements when table has an owner (Pablo Neira Ayuso)  
- ext4: use ext4_fc_tl_mem in fast-commit replay path (Eric Biggers)  
- f2fs: fix to avoid potential memory corruption in __update_iostat_latency() (Yangtao Li)  
- ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (Zhihao Cheng)  
- ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() (Zhihao Cheng)  
- ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap (Zhihao Cheng)  
- ubifs: ubifs_writepage: Mark page dirty after writing inode failed (Zhihao Cheng)  
- ubifs: dirty_cow_znode: Fix memleak in error handling path (Zhihao Cheng)  
- ubifs: Re-statistic cleaned znode count if commit failed (Zhihao Cheng)  
- ubi: Fix possible null-ptr-deref in ubi_free_volume() (Yang Yingliang)  
- ubifs: Fix memory leak in alloc_wbufs() (Li Zetao)  
- ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (Li Zetao)  
- ubi: Fix use-after-free when volume resizing failed (Li Zetao)  
- ubifs: Reserve one leb for each journal head while doing budget (Zhihao Cheng)  
- ubifs: do_rename: Fix wrong space budget when target inode's nlink &gt; 1 (Zhihao Cheng)  
- ubifs: Fix wrong dirty space budget for dirty inode (Zhihao Cheng)  
- ubifs: Rectify space budget for ubifs_xrename() (Zhihao Cheng)  
- ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted (Zhihao Cheng)  
- ubifs: Fix build errors as symbol undefined (Li Hua)  
- ubi: ensure that VID header offset + VID header size &lt;= alloc, size (George Kennedy)  
- um: vector: Fix memory leak in vector_config (Xiang Yang)  
- f2fs: allow set compression option of files without blocks (Yangtao Li)  
- fs: f2fs: initialize fsdata in pagecache_write() (Alexander Potapenko)  
- f2fs: use memcpy_{to,from}_page() where possible (Eric Biggers)  
- pwm: stm32-lp: fix the check on arr and cmp registers update (Fabrice Gasnier)  
- pwm: sifive: Always let the first pwm_apply_state succeed (Emil Renner Berthing)  
- pwm: sifive: Reduce time the controller lock is held (Uwe Kleine-Konig)  
- objtool: Fix memory leak in create_static_call_sections() (Miaoqian Lin)  
- fs/jfs: fix shift exponent db_agl2size negative (Liu Shixin via Jfs-discussion)  
- auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() (Jianglei Nie)  
- LTS version: v5.15.99 (Jack Vogel)  
- kbuild: Port silent mode detection to future gnu make. (Dmitry Goncharov)  
- wifi: ath9k: use proper statements in conditionals (Arnd Bergmann)  
- arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY (Robert Marko)  
- iommu/vt-d: Fix an unbalanced rcu_read_lock/rcu_read_unlock() (Christophe JAILLET)  
- media: uvcvideo: Fix memory leak of object map on error exit path (Colin Ian King)  
- qede: avoid uninitialized entries in coal_entry array (Michal Schmidt)  
- perf intel-pt: pkt-decoder: Add CFE and EVD packets (Adrian Hunter)  
- drm/edid: fix AVI infoframe aspect ratio handling (Jani Nikula)  
- drm/i915: Don't use BAR mappings for ring buffers with LLC (John Harrison)  
- drm/radeon: Fix eDP for single-display iMac11,2 (Mark Hawrylak)  
- drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv (Mavroudis Chatzilaridis)  
- vfio/type1: restore locked_vm (Steve Sistare)  
- vfio/type1: track locked_vm per dma (Steve Sistare)  
- vfio/type1: prevent underflow of locked_vm via exec() (Steve Sistare)  
- iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode (Jacob Pan)  
- PCI: Avoid FLR for AMD FCH AHCI adapters (Damien Le Moal)  
- PCI: hotplug: Allow marking devices as disconnected during bind/unbind (Lukas Wunner)  
- PCI/PM: Observe reset delay irrespective of bridge_d3 (Lukas Wunner)  
- MIPS: DTS: CI20: fix otg power gpio (H. Nikolaus Schaller)  
- riscv: ftrace: Reduce the detour code size to half (Guo Ren)  
- riscv: ftrace: Remove wasted nops for !RISCV_ISA_C (Guo Ren)  
- riscv, mm: Perform BPF exhandler fixup on page fault (Bjorn Topel)  
- riscv: jump_label: Fixup unaligned arch_static_branch function (Andy Chiu)  
- riscv: mm: fix regression due to update_mmu_cache change (Sergey Matyukevich)  
- RISC-V: add a spin_shadow_stack declaration (Conor Dooley)  
- scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (Tomas Henzl)  
- scsi: ses: Fix possible desc_ptr out-of-bounds accesses (Tomas Henzl)  
- scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (Tomas Henzl)  
- scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() (Tomas Henzl)  
- scsi: ses: Don't attach if enclosure has no components (James Bottomley)  
- tools/bootconfig: fix single &amp; used for logical condition (Antonio Alvarez Feijoo)  
- ring-buffer: Handle race between rb_move_tail and rb_check_pages (Mukesh Ojha)  
- ktest.pl: Add RUN_TIMEOUT option with default unlimited (Steven Rostedt)  
- ktest.pl: Fix missing 'end_monitor' when machine check fails (Steven Rostedt)  
- ktest.pl: Give back console on Ctrt^C on monitor (Steven Rostedt)  
- mm/thp: check and bail out if page in deferred queue already (Yin Fengwei)  
- mm: memcontrol: deprecate charge moving (Johannes Weiner)  
- docs: gdbmacros: print newest record (John Ogness)  
- remoteproc/mtk_scp: Move clk ops outside send_lock (Chen-Yu Tsai)  
- media: ipu3-cio2: Fix PM runtime usage_count in driver unbind (Sakari Ailus)  
- mips: fix syscall_get_nr (Elvira Khabirova)  
- dax/kmem: Fix leak of memory-hotplug resources (Dan Williams)  
- alpha: fix FEN fault handling (Al Viro)  
- ceph: update the time stamps and try to drop the suid/sgid (Xiubo Li)  
- rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (Ilya Dryomov)  
- fuse: add inode/permission checks to fileattr_get/fileattr_set (Alexander Mikhalitsyn)  
- ARM: dts: exynos: correct TMU phandle in Odroid HC1 (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Odroid XU (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Exynos5250 (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Odroid XU3 family (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Exynos4 (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Exynos4210 (Krzysztof Kozlowski)  
- ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node (Manivannan Sadhasivam)  
- dm flakey: fix a bug with 32-bit highmem systems (Mikulas Patocka)  
- dm flakey: don't corrupt the zero page (Mikulas Patocka)  
- dm flakey: fix logic when corrupting a bio (Mikulas Patocka)  
- thermal: intel: powerclamp: Fix cur_state for multi package system (Srinivas Pandruvada)  
- qede: fix interrupt coalescing configuration (Manish Chopra)  
- wifi: cfg80211: Fix use after free for wext (Alexander Wetzel)  
- wifi: ath11k: allow system suspend to survive ath11k (Len Brown)  
- wifi: rtl8xxxu: Use a longer retry limit of 48 (Bitterblue Smith)  
- dm: add cond_resched() to dm_wq_work() (Pingfan Liu)  
- dm: send just one event on resize, not two (Mikulas Patocka)  
- mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type (Louis Rannou)  
- mtd: spi-nor: spansion: Consider reserved bits in CFR5 register (Tudor Ambarus)  
- mtd: spi-nor: sfdp: Fix index value for SCCR dwords (Takahiro Kuwano)  
- ext4: refuse to create ea block when umounted (Jun Nie)  
- ext4: optimize ea_inode block expansion (Jun Nie)  
- jbd2: fix data missing when reusing bh which is ready to be checkpointed (Zhihao Cheng)  
- ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC (Lukasz Stelmach)  
- ALSA: ice1712: Do not left ice-&gt;gpio_mutex locked in aureon_add_controls() (Dmitry Fomin)  
- io_uring/poll: allow some retries for poll triggering spuriously (Jens Axboe)  
- io_uring: remove MSG_NOSIGNAL from recvmsg (David Lamparter)  
- io_uring/rsrc: disallow multi-source reg buffers (Pavel Begunkov)  
- io_uring: add a conditional reschedule to the IOPOLL cancelation loop (Jens Axboe)  
- io_uring: mark task TASK_RUNNING before handling resume/task work (Jens Axboe)  
- io_uring: handle TIF_NOTIFY_RESUME when checking for task_work (Jens Axboe)  
- crypto: qat - fix out-of-bounds read (Giovanni Cabiddu)  
- irqdomain: Fix domain registration race (Marc Zyngier)  
- irqdomain: Drop bogus fwspec-mapping error handling (Johan Hovold)  
- irqdomain: Look for existing mapping only once (Johan Hovold)  
- irqdomain: Fix disassociation race (Johan Hovold)  
- irqdomain: Fix association race (Johan Hovold)  
- ima: Align ima_file_mmap() parameters with mmap_file LSM hook (Roberto Sassu)  
- brd: return 0/-error from brd_insert_page() (Jens Axboe)  
- Documentation/hw-vuln: Document the interaction between IBRS and STIBP (KP Singh)  
- x86/speculation: Allow enabling STIBP with legacy IBRS (KP Singh)  
- x86/microcode/AMD: Fix mixed steppings support (Borislav Petkov (AMD))  
- x86/microcode/AMD: Add a @cpu parameter to the reloading functions (Borislav Petkov (AMD))  
- x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter (Borislav Petkov (AMD))  
- x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range (Yang Jihong)  
- x86/kprobes: Fix __recover_optprobed_insn check optimizing logic (Yang Jihong)  
- x86/reboot: Disable SVM, not just VMX, when stopping CPUs (Sean Christopherson)  
- x86/reboot: Disable virtualization in an emergency if SVM is supported (Sean Christopherson)  
- x86/crash: Disable virt in core NMI crash handler to avoid double shootdown (Sean Christopherson)  
- x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) (Sean Christopherson)  
- KVM: s390: disable migration mode when dirty tracking is disabled (Nico Boehr)  
- KVM: SVM: hyper-v: placate modpost section mismatch error (Randy Dunlap)  
- KVM: SVM: Fix potential overflow in SEV's send|receive_update_data() (Peter Gonda)  
- KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI (Sean Christopherson)  
- KVM: Destroy target device if coalesced MMIO unregistration fails (Sean Christopherson)  
- RDMA/siw: Fix user page pinning accounting (Bernard Metzler)  
- udf: Fix file corruption when appending just after end of preallocated extent (Jan Kara)  
- udf: Detect system inodes linked into directory hierarchy (Jan Kara)  
- udf: Preserve link count of system files (Jan Kara)  
- udf: Do not update file length for failed writes to inline files (Jan Kara)  
- udf: Do not bother merging very long extents (Jan Kara)  
- udf: Truncate added extents on failed expansion (Jan Kara)  
- selftests/landlock: Test ptrace as much as possible with Yama (Jeff Xu)  
- selftests/landlock: Skip overlayfs tests when not supported (Jeff Xu)  
- ocfs2: fix non-auto defrag path not working issue (Heming Zhao via Ocfs2-devel)  
- ocfs2: fix defrag path triggering jbd2 ASSERT (Heming Zhao via Ocfs2-devel)  
- f2fs: fix cgroup writeback accounting with fs-layer encryption (Eric Biggers)  
- f2fs: fix information leak in f2fs_move_inline_dirents() (Eric Biggers)  
- fs: dlm: send FIN ack back in right cases (Alexander Aring)  
- fs: dlm: move sending fin message into state change handling (Alexander Aring)  
- fs: dlm: don't set stop rx flag after node reset (Alexander Aring)  
- exfat: fix inode-&gt;i_blocks for non-512 byte sector size device (Yuezhang Mo)  
- exfat: redefine DIR_DELETED as the bad cluster number (Sungjong Seo)  
- exfat: fix unexpected EOF while reading dir (Yuezhang Mo)  
- exfat: fix reporting fs error when reading dir beyond EOF (Yuezhang Mo)  
- fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu)  
- hfs: fix missing hfs_bnode_get() in __hfs_bnode_create (Liu Shixin)  
- ARM: dts: exynos: correct HDMI phy compatible in Exynos4 (Krzysztof Kozlowski)  
- ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length (Namjae Jeon)  
- ksmbd: fix wrong data area length for smb2 lock request (Namjae Jeon)  
- locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath (Waiman Long)  
- btrfs: hold block group refcount during async discard (Boris Burkov)  
- cifs: Fix uninitialized memory read in smb3_qfs_tcon() (Volker Lendecke)  
- s390/kprobes: fix current_kprobe never cleared after kprobes reenter (Vasily Gorbik)  
- s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler (Vasily Gorbik)  
- s390: discard .interp section (Ilya Leoshkevich)  
- s390/extmem: return correct segment type in __segment_load() (Gerald Schaefer)  
- ipmi_ssif: Rename idle state and check (Corey Minyard)  
- rtc: pm8xxx: fix set-alarm race (Johan Hovold)  
- block: don't allow multiple bios for IOCB_NOWAIT issue (Jens Axboe)  
- firmware: coreboot: framebuffer: Ignore reserved pixel color bits (Alper Nebi Yasak)  
- wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu (Jun ASAKA)  
- drm/shmem-helper: Revert accidental non-GPL export (Asahi Lina)  
- nfsd: zero out pointers after putting nfsd_files on COPY setup error (Jeff Layton)  
- dm cache: add cond_resched() to various workqueue loops (Mike Snitzer)  
- dm thin: add cond_resched() to various workqueue loops (Mike Snitzer)  
- drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 (Darrell Kavanagh)  
- HID: logitech-hidpp: Don't restart communication if not necessary (Bastien Nocera)  
- scsi: snic: Fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- pinctrl: at91: use devm_kasprintf() to avoid potential leaks (Claudiu Beznea)  
- hwmon: (coretemp) Simplify platform device handling (Robin Murphy)  
- gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher)  
- regulator: s5m8767: Bounds check id indexing into arrays (Kees Cook)  
- regulator: max77802: Bounds check regulator id against opmode (Kees Cook)  
- ASoC: kirkwood: Iterate over array indexes instead of using pointer math (Kees Cook)  
- ASoC: soc-compress: Reposition and add pcm_mutex (???)  
- docs/scripts/gdb: add necessary make scripts_gdb step (Jakob Koschel)  
- drm/msm/dsi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)  
- drm: amd: display: Fix memory leakage (Konstantin Meskhidze)  
- Revert 'fbcon: don't lose the console font across generic-&gt;chip driver switch' (Thomas Zimmermann)  
- scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (Justin Tee)  
- drm/radeon: free iio for atombios when driver shutdown (Liwei Song)  
- drm/tiny: ili9486: Do not assume 8-bit only SPI controllers (Carlo Caione)  
- HID: Add Mapping for System Microphone Mute (Jingyuan Liang)  
- drm/omap: dsi: Fix excessive stack usage (Tomi Valkeinen)  
- drm/amd/display: Fix potential null-deref in dm_resume (Roman Li)  
- drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write (Ian Chen)  
- scm: add user copy checks to put_cmsg() (Eric Dumazet)  
- hv_netvsc: Check status in SEND_RNDIS_PKT completion message (Michael Kelley)  
- Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (Moises Cardona)  
- PM: EM: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- PM: domains: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- time/debug: Fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- s390/idle: mark arch_cpu_idle() noinstr (Heiko Carstens)  
- uaccess: Add minimum bounds check on kernel buffer size (Kees Cook)  
- coda: Avoid partial allocation of sig_inputArgs (Kees Cook)  
- net/mlx5: fw_tracer: Fix debug print (Shay Drory)  
- ACPI: video: Fix Lenovo Ideapad Z570 DMI match (Hans de Goede)  
- wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup (Lorenzo Bianconi)  
- tools/power/x86/intel-speed-select: Add Emerald Rapid quirk (Zhang Rui)  
- netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() (Alok Tiwari)  
- m68k: Check syscall_trace_enter() return code (Michael Schmitz)  
- net: bcmgenet: Add a check for oversized packets (Florian Fainelli)  
- crypto: hisilicon: Wipe entire pool on error (Kees Cook)  
- clocksource: Suspend the watchdog temporarily when high read latency detected (Feng Tang)  
- thermal: intel: intel_pch: Add support for Wellsburg PCH (Tim Zimmermann)  
- ACPI: Don't build ACPICA with '-Os' (Mark Rutland)  
- ice: add missing checks for PF vsi type (Jesse Brandeburg)  
- ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB (Siddaraju DH)  
- inet: fix fast path in __inet_hash_connect() (Pietro Borrello)  
- wifi: mt7601u: fix an integer underflow (Jisoo Jang)  
- wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds (Jisoo Jang)  
- x86/bugs: Reset speculation control settings on init (Breno Leitao)  
- timers: Prevent union confusion from unexpected restart_syscall() (Jann Horn)  
- thermal: intel: Fix unsigned comparison with less than zero (Yang Li)  
- wifi: ath11k: debugfs: fix to work with multiple PCI devices (Kalle Valo)  
- rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug (Zqiang)  
- rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() (Paul E. McKenney)  
- rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks (Paul E. McKenney)  
- wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (Jisoo Jang)  
- wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() (Minsuk Kang)  
- trace/blktrace: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- blk-iocost: fix divide by 0 error in calc_lcoefs() (Li Nan)  
- ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy (Markuss Broks)  
- udf: Define EFSCORRUPTED error code (Jan Kara)  
- rpmsg: glink: Avoid infinite loop on intent for missing channel (Bjorn Andersson)  
- media: saa7134: Use video_unregister_device for radio_dev (Tasos Sahanidis)  
- media: usb: siano: Fix use after free bugs caused by do_submit_urb (Duoming Zhou)  
- media: i2c: ov7670: 0 instead of -EINVAL was returned (Hans Verkuil)  
- media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (Duoming Zhou)  
- media: imx-jpeg: Apply clk_bulk api instead of operating specific clk (Ming Qian)  
- media: v4l2-jpeg: ignore the unknown APP14 marker (Ming Qian)  
- media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data (Ming Qian)  
- media: i2c: imx219: Fix binning for RAW8 capture (Jai Luthra)  
- media: i2c: imx219: Split common registers from mode tables (Adam Ford)  
- media: i2c: ov772x: Fix memleak in ov772x_probe() (Yuan Can)  
- media: ov5675: Fix memleak in ov5675_init_controls() (Shang XiaoJing)  
- media: ov2740: Fix memleak in ov2740_init_controls() (Shang XiaoJing)  
- media: max9286: Fix memleak in max9286_v4l2_register() (Shang XiaoJing)  
- builddeb: clean generated package content (Bastian Germann)  
- s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64 (Nathan Chancellor)  
- s390/vdso: remove -nostdlib compiler flag (Masahiro Yamada)  
- powerpc: Remove linker flag from KBUILD_AFLAGS (Nathan Chancellor)  
- media: platform: ti: Add missing check for devm_regulator_get (Jiasheng Jiang)  
- media: ti: cal: fix possible memory leak in cal_ctx_create() (Gaosheng Cui)  
- remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers (Sibi Sankar)  
- IB/hfi1: Fix sdma.h tx-&gt;num_descs off-by-one errors (Patrick Kelsey)  
- IB/hfi1: Fix math bugs in hfi1_can_pin_pages() (Patrick Kelsey)  
- iommu/vt-d: Allow to use flush-queue when first level is default (Tina Zhang)  
- iommu/vt-d: Use second level for GPA-&gt;HPA translation (Lu Baolu)  
- iommu/vt-d: Check FL and SL capability sanity in scalable mode (Lu Baolu)  
- iommu/vt-d: Remove duplicate identity domain flag (Lu Baolu)  
- iommu/vt-d: Fix error handling in sva enable/disable paths (Lu Baolu)  
- dmaengine: dw-axi-dmac: Do not dereference NULL structure (Kees Cook)  
- dmaengine: sf-pdma: pdma_desc memory leak fix (Shravan Chippa)  
- iommu: Fix error unwind in iommu_group_alloc() (Jason Gunthorpe)  
- iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (Dan Carpenter)  
- phy: rockchip-typec: fix tcphy_get_mode error case (Neill Kapron)  
- dmaengine: dw-edma: Fix readq_ch() return value truncation (Serge Semin)  
- tty: serial: imx: disable Ageing Timer interrupt request irq (Peng Fan)  
- tty: serial: imx: Handle RS485 DE signal active high (Marek Vasut)  
- serial: fsl_lpuart: fix RS485 RTS polariy inverse issue (Shenwei Wang)  
- RDMA/irdma: Cap MSIX used to online CPUs + 1 (Mustafa Ismail)  
- usb: max-3421: Fix setting of I/O pins (Mark Tomlinson)  
- RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() (Nikita Zhandarovich)  
- power: supply: remove faulty cooling logic (Andreas Kemnade)  
- iommu/vt-d: Set No Execute Enable bit in PASID table entry (Lu Baolu)  
- usb: gadget: configfs: Restrict symlink creation is UDC already binded (Udipto Goswami)  
- usb: gadget: configfs: remove using list iterator after loop body as a ptr (Jakob Koschel)  
- usb: gadget: configfs: use to_usb_function_instance() in cfg (un)link func (Linyu Yuan)  
- usb: gadget: configfs: use to_config_usb_cfg() in os_desc_link() (Linyu Yuan)  
- usb: musb: mediatek: don't unregister something that wasn't registered (Dan Carpenter)  
- RDMA/cxgb4: add null-ptr-check after ip_dev_find() (Nikita Zhandarovich)  
- tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case (Sherry Sun)  
- usb: early: xhci-dbc: Fix a potential out-of-bound memory access (Christophe JAILLET)  
- dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers (Serge Semin)  
- fotg210-udc: Add missing completion handler (Fabian Vogt)  
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (Chen Zhongjin)  
- drivers: base: transport_class: fix resource leak when transport_add_device() fails (Yang Yingliang)  
- drivers: base: transport_class: fix possible memory leak (Yang Yingliang)  
- driver core: fix resource leak in device_add() (Zhengchao Shao)  
- misc/mei/hdcp: Use correct macros to initialize uuid_le (Andy Shevchenko)  
- VMCI: check context-&gt;notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)  
- firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() (Yang Yingliang)  
- applicom: Fix PCI device refcount leak in applicom_init() (Xiongfeng Wang)  
- eeprom: idt_89hpesx: Fix error handling in idt_init() (Yuan Can)  
- Revert 'char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol' (Duoming Zhou)  
- serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init() (Yi Yang)  
- tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown() (Sherry Sun)  
- tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() (Sherry Sun)  
- PCI: switchtec: Return -EFAULT for copy_to_user() errors (Bjorn Helgaas)  
- PCI/IOV: Enlarge virtfn sysfs name buffer (Alexey V. Vissarionov)  
- usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count (Andy Shevchenko)  
- usb: typec: intel_pmc_mux: Use the helper acpi_dev_get_memory_resources() (Heikki Krogerus)  
- ACPI: resource: Add helper function acpi_dev_get_memory_resources() (Heikki Krogerus)  
- coresight: cti: Add PM runtime call in enable_store (Mao Jinlong)  
- coresight: cti: Prevent negative values of enable count (James Clark)  
- coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR (Junhao He)  
- media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible() (Hans Verkuil)  
- media: uvcvideo: Check controls flags before accessing them (Ricardo Ribalda)  
- media: uvcvideo: Use control names from framework (Ricardo Ribalda)  
- media: uvcvideo: Add support for V4L2_CTRL_TYPE_CTRL_CLASS (Ricardo Ribalda)  
- media: uvcvideo: refactor __uvc_ctrl_add_mapping (Ricardo Ribalda)  
- media: uvcvideo: Remove s_ctrl and g_ctrl (Ricardo Ribalda)  
- media: uvcvideo: Do not check for V4L2_CTRL_WHICH_DEF_VAL (Ricardo Ribalda)  
- alpha/boot/tools/objstrip: fix the check for ELF header (Al Viro)  
- kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai)  
- kobject: modify kobject_get_path() to take a const * (Greg Kroah-Hartman)  
- driver core: fix potential null-ptr-deref in device_add() (Yang Yingliang)  
- soundwire: cadence: Don't overflow the command FIFOs (Richard Fitzgerald)  
- i2c: designware: fix i2c_dw_clk_rate() return size to be u32 (Hanna Hawa)  
- usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe() (Gaosheng Cui)  
- iio: light: tsl2563: Do not hardcode interrupt trigger type (Ferry Toth)  
- dmaengine: HISI_DMA should depend on ARCH_HISI (Geert Uytterhoeven)  
- dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 (Fenghua Yu)  
- mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() (Qiheng Lin)  
- mfd: cs5535: Don't build on UML (Randy Dunlap)  
- objtool: add UACCESS exceptions for __tsan_volatile_read/write (Arnd Bergmann)  
- printf: fix errname.c list (Arnd Bergmann)  
- selftests/ftrace: Fix bash specific '==' operator (Masami Hiramatsu (Google))  
- sparc: allow PM configs for sparc32 COMPILE_TEST (Randy Dunlap)  
- perf tools: Fix auto-complete on aarch64 (Yicong Yang)  
- perf intel-pt: Do not try to queue auxtrace data on pipe (Namhyung Kim)  
- perf intel-pt: Add support for emulated ptwrite (Adrian Hunter)  
- perf intel-pt: Add link to the perf wiki's Intel PT page (Adrian Hunter)  
- perf intel-pt: Add documentation for Event Trace and TNT disable (Adrian Hunter)  
- perf inject: Use perf_data__read() for auxtrace (Namhyung Kim)  
- leds: led-core: Fix refcount leak in of_led_get() (Miaoqian Lin)  
- perf llvm: Fix inadvertent file creation (Ian Rogers)  
- gfs2: jdata writepage fix (Andreas Gruenbacher)  
- cifs: Fix warning and UAF when destroy the MR list (Zhang Xiaoxu)  
- cifs: Fix lost destroy smbd connection when MR allocate failed (Zhang Xiaoxu)  
- nfsd: fix race to check ls_layouts (Benjamin Coddington)  
- drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() (Asahi Lina)  
- hid: bigben_probe(): validate report count (Pietro Borrello)  
- HID: bigben: use spinlock to safely schedule workers (Pietro Borrello)  
- HID: bigben_worker() remove unneeded check on report_field (Pietro Borrello)  
- HID: bigben: use spinlock to protect concurrent accesses (Pietro Borrello)  
- ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared (Lucas Tanure)  
- spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() (Christophe JAILLET)  
- NFS: fix disabling of swap (NeilBrown)  
- nfs4trace: fix state manager flag printing (Benjamin Coddington)  
- NFSv4: keep state manager thread active if swap is enabled (NeilBrown)  
- dm: remove flush_scheduled_work() during local_exit() (Mike Snitzer)  
- ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init (Steffen Aschbacher)  
- hwmon: (mlxreg-fan) Return zero speed for broken fan (Vadim Pasternak)  
- spi: bcm63xx-hsspi: Fix multi-bit mode setting (William Zhang)  
- ASoC: codecs: lpass: fix incorrect mclk rate (Srinivas Kandagatla)  
- ASoC: codecs: tx-macro: move to individual clks from bulk (Srinivas Kandagatla)  
- ASoC: codecs: rx-macro: move to individual clks from bulk (Srinivas Kandagatla)  
- ASoC: codecs: tx-macro: move clk provider to managed variants (Srinivas Kandagatla)  
- ASoC: codecs: rx-macro: move clk provider to managed variants (Srinivas Kandagatla)  
- ASoC: codecs: Change bulk clock voting to optional voting in digital codecs (Srinivasa Rao Mandadapu)  
- HID: retain initial quirks set up when creating HID devices (Dmitry Torokhov)  
- HID: multitouch: Add quirks for flipped axes (Allen Ballway)  
- scsi: aic94xx: Add missing check for dma_map_single() (Jiasheng Jiang)  
- scsi: mpt3sas: Fix a memory leak (Tomas Henzl)  
- drm/amdgpu: fix enum odm_combine_mode mismatch (Arnd Bergmann)  
- hwmon: (ltc2945) Handle error case in ltc2945_value_store (Jonathan Cormier)  
- ASoC: dt-bindings: meson: fix gx-card codec node regex (Jerome Brunet)  
- ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params() (Nathan Chancellor)  
- ASoC: rsnd: fixup #endif position (Kuninori Morimoto)  
- ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove() (Claudiu Beznea)  
- ASoC: mchp-spdifrx: fix controls that works with completion mechanism (Claudiu Beznea)  
- ASoC: mchp-spdifrx: fix return value in case completion times out (Claudiu Beznea)  
- ASoC: mchp-spdifrx: fix controls which rely on rsr register (Claudiu Beznea)  
- spi: dw_bt1: fix MUX_MMIO dependencies (Arnd Bergmann)  
- gpio: vf610: connect GPIO label to dev name (Haibo Chen)  
- ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() (Kuninori Morimoto)  
- drm/mediatek: Clean dangling pointer on bind error path (Nicolas F. R. A. Prado)  
- drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc (ruanjinjie)  
- drm/mediatek: Drop unbalanced obj unref (Rob Clark)  
- drm/mediatek: Use NULL instead of 0 for NULL pointer (Miles Chen)  
- drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd (Xinlei Lee)  
- drm/msm/dpu: set pdpu-&gt;is_rt_pipe early in dpu_plane_sspp_atomic_update() (Dmitry Baryshkov)  
- drm/tegra: firewall: Check for is_addr_reg existence in IMM check (Mikko Perttunen)  
- gpu: host1x: Don't skip assigning syncpoints to channels (Mikko Perttunen)  
- pinctrl: mediatek: Initialize variable *buf to zero (Guodong Liu)  
- pinctrl: mediatek: Initialize variable pullen and pullup to zero (Guodong Liu)  
- pinctrl: mediatek: fix coding style (Zhiyong Tao)  
- pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback() (Andy Shevchenko)  
- drm/msm/mdp5: Add check for kzalloc (Jiasheng Jiang)  
- drm/msm/dpu: Add check for pstates (Jiasheng Jiang)  
- drm/msm/dpu: Add check for cstate (Jiasheng Jiang)  
- drm/msm: use strscpy instead of strncpy (Dmitry Baryshkov)  
- drm/msm/dsi: Allow 2 CTRLs on v2.5.0 (Konrad Dybcio)  
- drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags (Jagan Teki)  
- drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness (Daniel Mentz)  
- drm/bridge: lt9611: pass a pointer to the of node (Dmitry Baryshkov)  
- drm/bridge: lt9611: fix clock calculation (Dmitry Baryshkov)  
- drm/bridge: lt9611: fix programming of video modes (Dmitry Baryshkov)  
- drm/bridge: lt9611: fix polarity programming (Dmitry Baryshkov)  
- drm/bridge: lt9611: fix HPD reenablement (Dmitry Baryshkov)  
- drm/bridge: lt9611: fix sleep mode setup (Dmitry Baryshkov)  
- drm/msm/dpu: Disallow unallocated resources to be returned (Marijn Suijten)  
- drm/msm/gem: Add check for kmalloc (Jiasheng Jiang)  
- ALSA: hda/ca0132: minor fix for allocation size (Alexey V. Vissarionov)  
- drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() (Akhil P Oommen)  
- ASoC: fsl_sai: initialize is_dsp_mode flag (Shengjiu Wang)  
- ASoC: fsl_sai: Update to modern clocking terminology (Mark Brown)  
- drm/msm: clean event_thread-&gt;worker in case of an error (Dmitry Baryshkov)  
- drm/vc4: hdmi: Correct interlaced timings again (Dave Stevenson)  
- drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 (Dave Stevenson)  
- drm/vc4: hvs: Set AXI panic modes (Dave Stevenson)  
- pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (Miaoqian Lin)  
- pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain (Miaoqian Lin)  
- pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins (Adam Skladowski)  
- drm/msm/hdmi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang)  
- hwmon: (ftsteutates) Fix scaling of measurements (Armin Wolf)  
- gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() (Liang He)  
- drm: tidss: Fix pixel format definition (Randolph Sapp)  
- drm/vc4: dpi: Fix format mapping for RGB565 (Dave Stevenson)  
- drm/vc4: dpi: Add option for inverting pixel clock and output enable (Dave Stevenson)  
- drm/vkms: Fix null-ptr-deref in vkms_release() (Yuan Can)  
- drm/vkms: Fix memory leak in vkms_init() (Yuan Can)  
- drm/bridge: megachips: Fix error handling in i2c_register_driver() (Yuan Can)  
- drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC (Geert Uytterhoeven)  
- drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec (Frieder Schrempf)  
- drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats (Geert Uytterhoeven)  
- drm: Fix potential null-ptr-deref due to drmm_mode_config_init() (Shang XiaoJing)  
- sefltests: netdevsim: wait for devlink instance after netns removal (Jiri Pirko)  
- selftest: fib_tests: Always cleanup before exit (Roxana Nicolescu)  
- net: bcmgenet: fix MoCA LED control (Doug Berger)  
- l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() (Shigeru Yoshida)  
- selftests/net: Interpret UDP_GRO cmsg data as an int value (Jakub Sitnicki)  
- irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts (Florian Fainelli)  
- irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts (Florian Fainelli)  
- bpf: Fix global subprog context argument resolution logic (Andrii Nakryiko)  
- can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error (Frank Jungclaus)  
- thermal/drivers/hisi: Drop second sensor hi3660 (Yongqin Liu)  
- wifi: mac80211: make rate u32 in sta_set_rate_info_rx() (Shayne Chen)  
- crypto: crypto4xx - Call dma_unmap_page when done (Herbert Xu)  
- ACPI: resource: Do IRQ override on all TongFang GMxRGxx (Werner Sembach)  
- ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models (Adam Niederer)  
- selftests/bpf: Fix out-of-srctree build (Ilya Leoshkevich)  
- wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() (Dan Carpenter)  
- wifi: iwl4965: Add missing check for create_singlethread_workqueue() (Jiasheng Jiang)  
- wifi: iwl3945: Add missing check for create_singlethread_workqueue (Jiasheng Jiang)  
- RISC-V: time: initialize hrtimer based broadcast clock event device (Conor Dooley)  
- m68k: /proc/hardware should depend on PROC_FS (Randy Dunlap)  
- crypto: rsa-pkcs1pad - Use akcipher_request_complete (Herbert Xu)  
- libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() (Ilya Leoshkevich)  
- s390/ap: fix status returned by ap_qact() (Halil Pasic)  
- s390/ap: fix status returned by ap_aqic() (Halil Pasic)  
- Bluetooth: hci_qca: get wakeup status from serdev device handle (Zhengping Jiang)  
- Bluetooth: L2CAP: Fix potential user-after-free (Luiz Augusto von Dentz)  
- OPP: fix error checking in opp_migrate_dentry() (Qi Zheng)  
- tap: tap_open(): correctly initialize socket uid (Pietro Borrello)  
- tun: tun_chr_open(): correctly initialize socket uid (Pietro Borrello)  
- net: add sock_init_data_uid() (Pietro Borrello)  
- s390/vmem: fix empty page tables cleanup under KASAN (Vasily Gorbik)  
- s390/mem_detect: fix detect_memory() error handling (Vasily Gorbik)  
- irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe (Miaoqian Lin)  
- irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe (Miaoqian Lin)  
- irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (Miaoqian Lin)  
- irqchip: Fix refcount leak in platform_irqchip_probe (Miaoqian Lin)  
- net/mlx5: Enhance debug print in page allocation failure (Jack Morgenstein)  
- mt76: mt7915: fix polling firmware-own status (Felix Fietkau)  
- bpftool: profile online CPUs instead of possible (Tonghao Zhang)  
- crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware (Tom Lendacky)  
- crypto: ccp - Refactor out sev_fw_alloc() (Peter Gonda)  
- leds: led-class: Add missing put_device() to led_put() (Hans de Goede)  
- crypto: xts - Handle EBUSY correctly (Herbert Xu)  
- x86/microcode: Adjust late loading result reporting message (Ashok Raj)  
- x86/microcode: Check CPU capabilities after late microcode update correctly (Ashok Raj)  
- x86/microcode: Add a parameter to microcode_check() to store CPU capabilities (Ashok Raj)  
- x86/microcode: Print previous version of microcode after reload (Ashok Raj)  
- x86/microcode: Default-disable late loading (Borislav Petkov)  
- x86/microcode: Rip out the OLD_INTERFACE (Borislav Petkov)  
- x86: Mark stop_this_cpu() __noreturn (Peter Zijlstra)  
- powercap: fix possible name leak in powercap_register_zone() (Yang Yingliang)  
- crypto: seqiv - Handle EBUSY correctly (Herbert Xu)  
- crypto: essiv - Handle EBUSY correctly (Herbert Xu)  
- crypto: ccp - Failure on re-initialization due to duplicate sysfs filename (Koba Ko)  
- ACPI: battery: Fix missing NUL-termination with large strings (Armin Wolf)  
- wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() (Shivani Baranwal)  
- wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup (Miaoqian Lin)  
- wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (Minsuk Kang)  
- wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (Fedor Pchelkin)  
- ath9k: htc: clean up statistics macros (Pavel Skripkin)  
- ath9k: hif_usb: simplify if-if to if-else (Wan Jiabing)  
- wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function (Fedor Pchelkin)  
- wifi: orinoco: check return value of hermes_write_wordrec() (Alexey Kodanev)  
- wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU (Bitterblue Smith)  
- thermal/drivers/tsens: limit num_sensors to 9 for msm8939 (Dmitry Baryshkov)  
- thermal/drivers/tsens: fix slope values for msm8939 (Dmitry Baryshkov)  
- thermal/drivers/tsens: Sort out msm8976 vs msm8956 data (Dmitry Baryshkov)  
- thermal/drivers/tsens: Add compat string for the qcom,msm8960 (Dmitry Baryshkov)  
- thermal/drivers/tsens: Drop msm8976-specific defines (Dmitry Baryshkov)  
- ACPICA: nsrepair: handle cases without a return value correctly (Daniil Tatianin)  
- crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 (David Rientjes)  
- lib/mpi: Fix buffer overrun when SG is too long (Herbert Xu)  
- rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() (Frederic Weisbecker)  
- rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls (Frederic Weisbecker)  
- rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose (Frederic Weisbecker)  
- genirq: Fix the return type of kstat_cpu_irqs_sum() (Zhen Lei)  
- ACPICA: Drop port I/O validation for some regions (Mario Limonciello)  
- crypto: x86/ghash - fix unaligned access in ghash_setkey() (Eric Biggers)  
- wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() (Zhengchao Shao)  
- wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (Zhang Changzhong)  
- wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() (Zhang Changzhong)  
- wifi: ipw2200: fix memory leak in ipw_wdev_init() (Zhengchao Shao)  
- wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- libbpf: Fix btf__align_of() by taking into account field offsets (Andrii Nakryiko)  
- wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() (Li Zetao)  
- wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: libertas: fix memory leak in lbs_init_adapter() (Zhengchao Shao)  
- wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave() (Yang Yingliang)  
- wifi: rsi: Fix memory leak in rsi_coex_attach() (Yuan Can)  
- arm64: dts: qcom: pmk8350: Use the correct PON compatible (Konrad Dybcio)  
- arm64: dts: qcom: pmk8350: Specify PBS register for PON (Konrad Dybcio)  
- KEYS: asymmetric: Fix ECDSA use via keyctl uapi (Denis Kenzior)  
- x86/perf/zhaoxin: Add stepping check for ZXC (silviazhao)  
- sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello)  
- sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() (Dietmar Eggemann)  
- s390/dasd: Fix potential memleak in dasd_eckd_init() (Qiheng Lin)  
- arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions (Jamie Douglass)  
- blk-mq: correct stale comment of .get_budget (Kemeng Shi)  
- blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx (Kemeng Shi)  
- blk-mq: avoid sleep in blk_mq_alloc_request_hctx (Kemeng Shi)  
- arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node (AngeloGioacchino Del Regno)  
- arm64: dts: mt8192: Fix CPU map for single-cluster SoC (AngeloGioacchino Del Regno)  
- ARM: dts: imx7s: correct iomuxc gpr mux controller cells (Peng Fan)  
- ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference (Samuel Holland)  
- arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN (Christian Hewitt)  
- arm64: dts: renesas: beacon-renesom: Fix gpio expander reference (Adam Ford)  
- locking/rwsem: Disable preemption in all down_read*() and up_read() code paths (Waiman Long)  
- locking/rwsem: Optimize down_read_trylock() under highly contended case (Muchun Song)  
- locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter (Waiman Long)  
- locking/rwsem: Make handoff bit handling more consistent (Waiman Long)  
- arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip (Neil Armstrong)  
- arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name (Neil Armstrong)  
- arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name (Neil Armstrong)  
- arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names (Neil Armstrong)  
- arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name (Neil Armstrong)  
- arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name (Neil Armstrong)  
- arm64: dts: amlogic: meson-gx: add missing unit address to rng node name (Neil Armstrong)  
- arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property (Neil Armstrong)  
- arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible (Neil Armstrong)  
- arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name (Neil Armstrong)  
- arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name (Neil Armstrong)  
- ARM: imx: Call ida_simple_remove() for ida_simple_get (Angus Chen)  
- ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato (Krzysztof Kozlowski)  
- arm64: dts: ti: k3-j7200: Fix wakeup pinmux range (Vaishnav Achath)  
- ARM: s3c: fix s3c64xx_set_timer_source prototype (Arnd Bergmann)  
- ARM: bcm2835_defconfig: Enable the framebuffer (Stefan Wahren)  
- ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() (Yang Yingliang)  
- arm64: dts: meson: remove CPU opps below 1GHz for G12A boards (Christian Hewitt)  
- arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names (Robert Marko)  
- arm64: dts: qcom: ipq8074: fix Gen3 PCIe node (Robert Marko)  
- arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges (Robert Marko)  
- arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY (Robert Marko)  
- arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size (Johan Hovold)  
- arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes (Shawn Guo)  
- arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names (Robert Marko)  
- arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem (Petr Vorel)  
- arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size (Petr Vorel)  
- arm64: dts: msm8992-bullhead: add memory hole region (Dominik Kobinski)  
- arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address (Martin Blumenstingl)  
- arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name (Martin Blumenstingl)  
- arm64: dts: meson-gx: Fix Ethernet MAC address unit name (Martin Blumenstingl)  
- arm64: dts: qcom: sc7280: correct SPMI bus address cells (Krzysztof Kozlowski)  
- arm64: dts: qcom: sc7180: correct SPMI bus address cells (Krzysztof Kozlowski)  
- arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name (Krzysztof Kozlowski)  
- arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description (Chen-Yu Tsai)  
- ARM: zynq: Fix refcount leak in zynq_early_slcr_init (Qiheng Lin)  
- arm64: dts: imx8m: Align SoC unique ID node unit address (Marek Vasut)  
- arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings (Marijn Suijten)  
- arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k (Marijn Suijten)  
- arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up (Konrad Dybcio)  
- arm64: dts: qcom: qcs404: use symbol names for PCIe resets (Dmitry Baryshkov)  
- ARM: OMAP2+: Fix memory leak in realtime_counter_init() (Chen Hui)  
- powerpc/mm: Rearrange if-else block to avoid clang warning (Anders Roxell)  
- HID: asus: use spinlock to safely schedule workers (Pietro Borrello)  
- HID: asus: use spinlock to protect concurrent accesses (Pietro Borrello)  
- LTS version: v5.15.98 (Jack Vogel)  
- io_uring: ensure that io_init_req() passes in the right issue_flags (Jens Axboe)  
- LTS version: v5.15.97 (Jack Vogel)  
- io_uring: add missing lock in io_get_file_fixed (Bing-Jhong Billy Jheng)  
- USB: core: Don't hold device lock while reading the 'descriptors' sysfs file (Alan Stern)  
- usb: gadget: u_serial: Add null pointer check in gserial_resume (Prashanth K)  
- USB: serial: option: add support for VW/Skoda 'Carstick LTE' (Florian Zumbiehl)  
- usb: dwc3: pci: add support for the Intel Meteor Lake-M (Heikki Krogerus)  
- scripts/tags.sh: fix incompatibility with PCRE2 (Carlos Llamas)  
- scripts/tags.sh: Invoke 'realpath' via 'xargs' (Cristian Ciocaltea)  
- vc_screen: don't clobber return value in vcs_read (Thomas Weissschuh)  
- net: Remove WARN_ON_ONCE(sk-&gt;sk_forward_alloc) from sk_stream_kill_queues(). (Kuniyuki Iwashima)  
- bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state (Martin KaFai Lau)  
- staging: mt7621-dts: change palmbus address to lower case (Sergio Paracuellos)  
- x86/cpu: Add Lunar Lake M (Kan Liang)  
- HID: core: Fix deadloop in hid_apply_multiplier. (Xin Zhao)  
- neigh: make sure used and confirmed times are valid (Julian Anastasov)  
- IB/hfi1: Assign npages earlier (Dean Luick)  
- ASoC: rt715-sdca: fix clock stop prepare timeout issue (Jack Yu)  
- btrfs: send: limit number of clones and allocated memory size (David Sterba)  
- ACPI: NFIT: fix a potential deadlock during NFIT teardown (Vishal Verma)  
- HID: elecom: add support for TrackBall 056E:011C (Takahiro Fujii)  
- ARM: dts: rockchip: add power-domains property to dp node on rk3288 (Johan Jonker)  
- arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc (Krzysztof Kozlowski)  
- Fix XFRM-I support for nested ESP tunnels (Benedict Wong)  
- arm64: kdump: Increase reserved memory for larger machines (Henry Willard)  [Orabug: 34580154] 
- Revert 'add NETFILTER suppport' (Gerd Rausch)  [Orabug: 34849756] 
- iommu/vt-d: Fix buggy QAT device mask (Jacob Pan)  [Orabug: 35007156] 
- iommu/vt-d: Add a fix for devices need extra dtlb flush (Jacob Pan)  [Orabug: 35007156] 
- net/rds: Check that 'tc-&gt;t_rtn' has been assigned already (Gerd Rausch)  [Orabug: 35075322] 

libkcapi
[1.3.1-3.0.1]
- Change distroname_ext in spec file to oracle

nettle
[3.8-3]
- Rebuild in new side-tag

gmp
[1:6.2.0-10]
- Add the support for intel CET
Resolves: rhbz#1977890</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2024-12212.html" type="self" title="ELBA-2024-12212" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="kernel-uek-debug-modules-extra" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-modules-extra-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">4e29abca2b933f39450cc939fb9c0dd02bafabd8f24f02ac056b3c2015fc1f63</sum>
        </package>
        <package name="kernel-uek-debug-modules" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-modules-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">8f117f75b58b400f8863a5c6f6057adec257c3b4dcf09e81bcff4d4cfd780f61</sum>
        </package>
        <package name="kernel-uek-debug-core" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-core-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">e15353147dd39d2863bdd63764cb99c6c6f37a3955c9ab422cc628f622d70a91</sum>
        </package>
        <package name="libkcapi-hmaccalc" version="1.3.1" release="3.0.1.el9" epoch="0" arch="aarch64">
          <filename>libkcapi-hmaccalc-1.3.1-3.0.1.el9.aarch64.rpm</filename>
          <sum type="sha256">2341956d4f3e9dc974dad7194f2a6c87317bcdea1dfec72f46ade4dbdad33419</sum>
        </package>
        <package name="gmp-c++" version="6.2.0" release="10.el9" epoch="1" arch="aarch64">
          <filename>gmp-c++-6.2.0-10.el9.aarch64.rpm</filename>
          <sum type="sha256">986f269956dfa13ea4a822e37634b0daae0c9998c0a313ba95cbf0c9bbab935c</sum>
        </package>
        <package name="kernel-uek-devel" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-devel-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">634ccb1609d56bf859d5d1d529240453c153673b297de67837f0cbd9b6b2f623</sum>
        </package>
        <package name="kernel-uek-debug-devel" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-devel-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">1375c065177d2d325aeffd9e36459d98bcf5f861bb843e6be627cb5a63d82684</sum>
        </package>
        <package name="kernel-uek-doc" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="noarch">
          <filename>kernel-uek-doc-5.15.0-101.103.2.1.el9uek.noarch.rpm</filename>
          <sum type="sha256">299746608d1a9616d800bab8abadfe0e57a8e83384a74e8db1527c6db612c03a</sum>
        </package>
        <package name="nettle-devel" version="3.8" release="3.el9_0" epoch="0" arch="aarch64">
          <filename>nettle-devel-3.8-3.el9_0.aarch64.rpm</filename>
          <sum type="sha256">9540b8ab32ca4181dffe2445f4c018b8d5a8e9829b5caeba2ce6ba5207587cd2</sum>
        </package>
        <package name="libkcapi" version="1.3.1" release="3.0.1.el9" epoch="0" arch="src">
          <filename>libkcapi-1.3.1-3.0.1.el9.src.rpm</filename>
          <sum type="sha256">6d73063faf0e639195aa39aa6c3b9f62f9401c8dccfaae7851ead33115a22048</sum>
        </package>
        <package name="gmp" version="6.2.0" release="10.el9" epoch="1" arch="src">
          <filename>gmp-6.2.0-10.el9.src.rpm</filename>
          <sum type="sha256">5583b1846c55b1786dde97726636e757d58e92c3d3accac196fd3900278c098f</sum>
        </package>
        <package name="kernel-uek-core" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-core-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">951cec2811310578ffeb6f70bff87569f1e49e9fa6e597040e356ab8a1c15c53</sum>
        </package>
        <package name="gmp-devel" version="6.2.0" release="10.el9" epoch="1" arch="aarch64">
          <filename>gmp-devel-6.2.0-10.el9.aarch64.rpm</filename>
          <sum type="sha256">b9250dacbb25c0e4b6f3b4d7b69c3fa618b844912ab37dc3eaa34c56c54c2031</sum>
        </package>
        <package name="kernel-uek" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">9fa8d6cda528656b3abfc3973c7d46f927785f36fc38958ad50710e8a9b14be0</sum>
        </package>
        <package name="kernel-uek-modules-extra" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-modules-extra-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">d2ff09e7059ba60e192e45569e0365404c33d3002d27b6a5b7a81123571162b9</sum>
        </package>
        <package name="nettle" version="3.8" release="3.el9_0" epoch="0" arch="src">
          <filename>nettle-3.8-3.el9_0.src.rpm</filename>
          <sum type="sha256">8f67ea51932ba3195402cdac06b8a30437e5234b834c6ae4095c3d6e469e002f</sum>
        </package>
        <package name="nettle" version="3.8" release="3.el9_0" epoch="0" arch="aarch64">
          <filename>nettle-3.8-3.el9_0.aarch64.rpm</filename>
          <sum type="sha256">9569a694b43f7e56a25100b03e0f52fdc11967b8f1137ad49fd589498b8a3004</sum>
        </package>
        <package name="kernel-uek" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="src">
          <filename>kernel-uek-5.15.0-101.103.2.1.el9uek.src.rpm</filename>
          <sum type="sha256">3709c44c0532500c5dd5ad99fef80114adba0f5f04c446cc554fc33bef65f061</sum>
        </package>
        <package name="kernel-uek-modules" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-modules-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">ede9d438464ace00530ad726f72159e312fd31e71ae6aa415023f05cae2eb69a</sum>
        </package>
        <package name="libkcapi" version="1.3.1" release="3.0.1.el9" epoch="0" arch="aarch64">
          <filename>libkcapi-1.3.1-3.0.1.el9.aarch64.rpm</filename>
          <sum type="sha256">37679f15a28b7ea9f52f7f0fd5391ffdfd930bf2f21506500cfec9325b622abc</sum>
        </package>
        <package name="kernel-uek-debug" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">7bcf06d4628124f664c436646335ac5723d8087ccfbe4b5274ed8f19672deafc</sum>
        </package>
        <package name="gmp" version="6.2.0" release="10.el9" epoch="1" arch="aarch64">
          <filename>gmp-6.2.0-10.el9.aarch64.rpm</filename>
          <sum type="sha256">514bac60ea7455b80009cdb085780f184a78994bd4f8eaf2b23486e4c81a0ac9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2022-4127</id>
    <title> gmp</title>
    <release>Oracle Linux 9</release>
    <issued date="2022-06-30 00:00:00"/>
    <updated date="2022-06-30 00:00:00"/>
    <rights>Copyright 2022 Oracle, Inc.</rights>
    <description>[1:6.2.0-10]
- Add the support for intel CET
Resolves: rhbz#1977890

[1:6.2.0-9]
- Move the .hmac files to the fipscheck subfolder
- Make symlinks from their original location (Fedora contains the .hmac files there) pointing to their new location
Resolves: rhbz#1980758

[1:6.2.0-8]
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
  Related: rhbz#1991688

[1:6.2.0-7]
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

[1:6.2.0-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

[1:6.2.0-5]
- Move gmpxx.pc to -devel subpackage as well

[1:6.2.0-4]
- The pkgcfg file should be in devel

[1:6.2.0-3]
- Use make macros

[1:6.2.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

[1:6.2.0-1]
- Rebase to 6.2.0

[1:6.1.2-13]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

[1:6.1.2-12]
- Reenable the fat binaries build option</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2022-4127.html" type="self" title="ELBA-2022-4127" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="gmp-devel" version="6.2.0" release="10.el9" epoch="1" arch="aarch64">
          <filename>gmp-devel-6.2.0-10.el9.aarch64.rpm</filename>
          <sum type="sha256">b9250dacbb25c0e4b6f3b4d7b69c3fa618b844912ab37dc3eaa34c56c54c2031</sum>
        </package>
        <package name="gmp-c++" version="6.2.0" release="10.el9" epoch="1" arch="aarch64">
          <filename>gmp-c++-6.2.0-10.el9.aarch64.rpm</filename>
          <sum type="sha256">986f269956dfa13ea4a822e37634b0daae0c9998c0a313ba95cbf0c9bbab935c</sum>
        </package>
        <package name="gmp" version="6.2.0" release="10.el9" epoch="1" arch="src">
          <filename>gmp-6.2.0-10.el9.src.rpm</filename>
          <sum type="sha256">5583b1846c55b1786dde97726636e757d58e92c3d3accac196fd3900278c098f</sum>
        </package>
        <package name="gmp" version="6.2.0" release="10.el9" epoch="1" arch="aarch64">
          <filename>gmp-6.2.0-10.el9.aarch64.rpm</filename>
          <sum type="sha256">514bac60ea7455b80009cdb085780f184a78994bd4f8eaf2b23486e4c81a0ac9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2026-50345</id>
    <title> openssl security fix update</title>
    <severity>Moderate</severity>
    <release>Oracle Linux 9</release>
    <issued date="2026-06-24 00:00:00"/>
    <updated date="2026-06-24 00:00:00"/>
    <rights>Copyright 2026 Oracle, Inc.</rights>
    <description>[3.5.5-3.0.1]
- Replace upstream references in fips man pages [Orabug: 35824276]
- Update additional upstream references
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name [Orabug: 35824276]
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]

[1:3.5.5-3]
- Fix CVE-2026-28390
  Resolves: RHEL-165870

[1:3.5.5-2]
- Fix CVE-2026-31790
  Resolves: RHEL-161586

[1:3.5.5-1]
- Rebase to OpenSSL 3.5.5
  Resolves: RHEL-136895
  Resolves: RHEL-142004
  Resolves: RHEL-142012
  Resolves: RHEL-142020
  Resolves: RHEL-142024
  Resolves: RHEL-142028
  Resolves: RHEL-142032
  Resolves: RHEL-142036
  Resolves: RHEL-142040
  Resolves: RHEL-142044
  Resolves: RHEL-142048
  Resolves: RHEL-142052
  Resolves: RHEL-142056</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2026-50345.html" type="self" title="ELSA-2026-50345" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-28390.html" id="CVE-2026-28390" type="cve" title="CVE-2026-28390" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="openssl" version="3.5.5" release="3.0.1.el9_8_fips" epoch="10" arch="src">
          <filename>openssl-3.5.5-3.0.1.el9_8_fips.src.rpm</filename>
          <sum type="sha256">762ac053997a7e790236d4e3986cc07e6fb9171ea9f2f4a0d6f2b87d28a7e218</sum>
        </package>
        <package name="openssl-perl" version="3.5.5" release="3.0.1.el9_8_fips" epoch="10" arch="aarch64">
          <filename>openssl-perl-3.5.5-3.0.1.el9_8_fips.aarch64.rpm</filename>
          <sum type="sha256">067505cf5d3322293ccdd09a27d695f923263cddd9df83d81125aeba8e2ff45d</sum>
        </package>
        <package name="openssl-devel" version="3.5.5" release="3.0.1.el9_8_fips" epoch="10" arch="aarch64">
          <filename>openssl-devel-3.5.5-3.0.1.el9_8_fips.aarch64.rpm</filename>
          <sum type="sha256">e872fc341efbed4ba2b203272abe2ebf1f92c06ffff25eb4c450fde88e125359</sum>
        </package>
        <package name="openssl" version="3.5.5" release="3.0.1.el9_8_fips" epoch="10" arch="aarch64">
          <filename>openssl-3.5.5-3.0.1.el9_8_fips.aarch64.rpm</filename>
          <sum type="sha256">928c0d0468533b3fdb3291a910370f163f90783c5e38a163235a391b594a81e6</sum>
        </package>
        <package name="openssl-libs" version="3.5.5" release="3.0.1.el9_8_fips" epoch="10" arch="aarch64">
          <filename>openssl-libs-3.5.5-3.0.1.el9_8_fips.aarch64.rpm</filename>
          <sum type="sha256">5cb0f4130781f42238cc2f8b84eeb5415fb5d2fe97146a8fe41573b0d5bfd8e1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2024-12675</id>
    <title>openssl security update</title>
    <severity>Moderate</severity>
    <release>Oracle Linux 9</release>
    <issued date="2024-09-19 00:00:00"/>
    <updated date="2024-09-19 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[3.0.7-28.0.1_fips]
- Replace upstream references in fips man pages [Orabug: 35824276]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name and remove upstream references from
  fips_module_indicators manpage [Orabug: 35824276]

[3.0.7-28.0.1]
- Drop OpenELA branding, apply Oracle branding patches
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]

[1:3.0.7-28]
- Patch for CVE-2024-6119
  Resolves: RHEL-55340</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2024-12675.html" type="self" title="ELSA-2024-12675" />
      <reference href="https://linux.oracle.com/cve/CVE-2024-6119.html" id="CVE-2024-6119" type="cve" title="CVE-2024-6119" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="openssl-devel" version="3.0.7" release="28.0.1.el9_4_fips" epoch="10" arch="aarch64">
          <filename>openssl-devel-3.0.7-28.0.1.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">e6c30e91e24639b1063698e6c3fb5e0169ff14c23f4d9b10c2d85666b13e52bf</sum>
        </package>
        <package name="openssl" version="3.0.7" release="28.0.1.el9_4_fips" epoch="10" arch="src">
          <filename>openssl-3.0.7-28.0.1.el9_4_fips.src.rpm</filename>
          <sum type="sha256">7d48694a644552f515eff1f12115600b8ad6f962992a8ffc829588db636601f3</sum>
        </package>
        <package name="openssl-perl" version="3.0.7" release="28.0.1.el9_4_fips" epoch="10" arch="aarch64">
          <filename>openssl-perl-3.0.7-28.0.1.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">f087f871fbce0eeec947fe5aadc208286c8cd14d853656803d32cbe07c4d03c5</sum>
        </package>
        <package name="openssl-libs" version="3.0.7" release="28.0.1.el9_4_fips" epoch="10" arch="aarch64">
          <filename>openssl-libs-3.0.7-28.0.1.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">c744f7e3e21e3ca9cdf951a10384b30ebd5024b89ef5f63659667ec7dc955c8f</sum>
        </package>
        <package name="openssl" version="3.0.7" release="28.0.1.el9_4_fips" epoch="10" arch="aarch64">
          <filename>openssl-3.0.7-28.0.1.el9_4_fips.aarch64.rpm</filename>
          <sum type="sha256">0e93d3d7f7b3f43d7518674d740b14594d5e1cc392f3f53509531df2b1a425ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2024-12893</id>
    <title> nss  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2024-12-21 00:00:00"/>
    <updated date="2024-12-21 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[3.101.0-10.el9_u2_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35862190]
- Update FIPS module name for Oracle Linux [Orabug: 35862190]

[3.101.0-10]
- Allow RSA-OAEP in FIPS mode

[3.101.0-9]
- Add SEC_OID_CURVE25519 to FIPS checks.
- This will mark algorithms using it as FIPS unapproved.

[3.101.0-8]
- fix shlibsign in FIPS mode
- remove dbm from pkgconfig</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2024-12893.html" type="self" title="ELBA-2024-12893" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="nss-softokn" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">01e3617ac075476debb1e197b4d66e5bbb8fa752252527b1db20cbbf6496e1a2</sum>
        </package>
        <package name="nss" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">f7d53fe7ccb5ac0fd91b0f8b25995a5d340ab27256d1134a3fe6452246936cd4</sum>
        </package>
        <package name="nss-softokn-devel" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-devel-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">b4ac1b9fdc7374b66df7fac0a5fe7c276c6c7b75855a2ee1d5c4fc4fd4aa0973</sum>
        </package>
        <package name="nss-softokn-freebl-devel" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-devel-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">2618c92c9df703fa2ceec847dbdc3679f9b8839bcf852b951193625f808dc658</sum>
        </package>
        <package name="nss" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="src">
          <filename>nss-3.101.0-10.el9_2_fips.src.rpm</filename>
          <sum type="sha256">2d266aa1fb92f07d4c6ad8c6f37f388afbbbb344d192b1e4290603a594fd2c71</sum>
        </package>
        <package name="nss-util-devel" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-util-devel-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">2f1792a6e57d90b16436f6afd340a5716bfbd53c12fa3fe9c0d6d51d81d7654b</sum>
        </package>
        <package name="nspr-devel" version="4.35.0" release="17.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nspr-devel-4.35.0-17.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">81164b88c821e5a654965d53192751619268e520d4015ef5fb3ec6548207cc1f</sum>
        </package>
        <package name="nss-softokn-freebl" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">8c21d1ce99313ad6a0db00d96df538cb927da823927d3e28e95d1f90422f8fc0</sum>
        </package>
        <package name="nss-tools" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-tools-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">9510da814d0d322de470e1910eda0b048135cd9186b6a43a6cb51e4f417ea999</sum>
        </package>
        <package name="nss-devel" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-devel-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">03b507f5b3e777750d7c20a3e78aa32ab1a86a39542ee6e9c93334bc7628eee2</sum>
        </package>
        <package name="nss-pkcs11-devel" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-pkcs11-devel-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">b7c71acfb41dec6627a89a9c3578cf49040d2f9eb287f078744200ff415f85fa</sum>
        </package>
        <package name="nspr" version="4.35.0" release="17.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nspr-4.35.0-17.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">36fc7a453b9804ac9601663428a0ab77879431ba68b9c0a8dcc8a5bbf8281e52</sum>
        </package>
        <package name="nss-util" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-util-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">e551727958aebab3226fa7959f14dccbe60f43aa33d0e9064bd867efd830ef9c</sum>
        </package>
        <package name="nss-sysinit" version="3.101.0" release="10.el9_2_fips" epoch="10" arch="aarch64">
          <filename>nss-sysinit-3.101.0-10.el9_2_fips.aarch64.rpm</filename>
          <sum type="sha256">abb94713aee77a3f5e41521098b6496f9707206ec18d62cc422f900d155f58fb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2025-20205</id>
    <title> Unbreakable Enterprise kernel  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2025-04-01 00:00:00"/>
    <updated date="2025-04-01 00:00:00"/>
    <rights>Copyright 2025 Oracle, Inc.</rights>
    <description>[5.15.0-303.171.5.2.2]
- Uek-rpm/ol9: Enable CONFIG_FIPS_SIGNATURE_SELFTEST for mips64 (Vijay Kumar)  [Orabug: 37509583] 
- uek-rpm: Enable CONFIG_FIPS_SIGNATURE_SELFTEST for all archs (Saeed Mirzamohammadi)  [Orabug: 37509575] 
- Revert 'crypto: jitter - permanent and intermittent health errors' (Saeed Mirzamohammadi)  [Orabug: 37492621] 
- Revert 'crypto: jitter - correct health test during initialization' (Saeed Mirzamohammadi)  [Orabug: 37492621]

[5.15.0-303.171.5.2.1]
- cgroup: cgroup-v1: do not exclude cgrp_dfl_root (Vishal Verma)  [Orabug: 37410450]
- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37423790]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37423790]

[5.15.0-303.171.5.2]
- build: populate modules_thick.builtin for dirs containing only modules (Nick Alcock)  [Orabug: 37393454]
- x86/pkeys: Ensure updated PKRU value is XRSTOR'd (Aruna Ramakrishna)  [Orabug: 37384237]
- x86/pkeys: Change caller of update_pkru_in_sigframe() (Aruna Ramakrishna)  [Orabug: 37384237]
- Revert 'ocfs2: fix the la space leak when unmounting an ocfs2 volume' (Sherry Yang)  [Orabug: 37383283]

[5.15.0-303.171.5.1]
- sunrpc: fix a NULL deref in svc_process() when -&gt;sv_stats doesn't exist (Calum Mackay)  [Orabug: 37346134]

[5.15.0-303.171.5]
- intel_idle: fix ACPI _CST matching for newer Xeon platforms (Artem Bityutskiy)  [Orabug: 37249457]
- x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram (Peter Zijlstra)  [Orabug: 37249457]
- perf/tests: Add AMX instructions to x86 instruction decoder test (Adrian Hunter)  [Orabug: 37249457]
- x86/insn: Add AMX instructions to the x86 instruction decoder (Adrian Hunter)  [Orabug: 37249457]
- intel_idle: add Granite Rapids Xeon support (Artem Bityutskiy)  [Orabug: 37249457]
- cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again* (Peter Zijlstra)  [Orabug: 37249457]
- intel_idle: Fix false positive RCU splats due to incorrect hardirqs state (Waiman Long)  [Orabug: 37249457]
- cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE (Peter Zijlstra)  [Orabug: 37249457]
- intel_idle: Add a new flag to initialize the AMX state (Chang S. Bae)  [Orabug: 37249457]
- x86/fpu: Add a helper to prepare AMX state for low-power CPU idle (Chang S. Bae)  [Orabug: 37249457]
- intel_idle: enable interrupts before C1 on Xeons (Artem Bityutskiy)  [Orabug: 37249457]

[5.15.0-303.171.4]
- rds: recv_payload_bad_checksum was not 0 after running rds-stress on UEK6 (William Kucharski)  [Orabug: 37265126]
- rds: If RDS Checksums are enabled for RDMA RDS operations, the extension headers will overflow causing incorrect operation (William Kucharski)  [Orabug: 37265124]
- rds: rds_message_alloc() needlessly zeroes m_used_sgs (William Kucharski)  [Orabug: 37265122]
- rds: tracepoint in rds_receive_csum_err() prints pointless information (William Kucharski)  [Orabug: 37265120]
- rds: rds_inc_init() should initialize the inc-&gt;i_conn_path field (William Kucharski)  [Orabug: 37265116]
- rds: Race condition in adding RDS payload checksum extension header may result in RDS header corruption (William Kucharski)  [Orabug: 37265114]
- Revert 'net/mlx5: disable the 'fast unload' feature on Exadata systems' (Qing Huang)  [Orabug: 37285222]
- Revert 'net/mlx5: pretend 'fast unload' succeeded on Exadata systems' (Qing Huang)  [Orabug: 37285222]
- RDMA/mlx5: Fix Shared PD prefetch of ODP memory region (Mark Haywood)  [Orabug: 31688618] [Orabug: 37279176]
- blk-mq: fix missing blk_account_io_done() in error path (Yu Kuai)  [Orabug: 37228086]
- rds: Add rds stuck shutdown timeout (Rohit Nair)  [Orabug: 37214078]
- KVM: x86: Stop compiling vmenter.S with OBJECT_FILES_NON_STANDARD (Sean Christopherson)  [Orabug: 37273739]
- KVM: SVM: Create a stack frame in __svm_sev_es_vcpu_run() (Sean Christopherson)  [Orabug: 37273739]
- KVM: SVM: Create a stack frame in __svm_vcpu_run() for unwinding (Sean Christopherson)  [Orabug: 37273739]
- mm/memory-failure: pass the folio and the page to collect_procs() (Matthew Wilcox (Oracle))  [Orabug: 37270260]
- LTS version: v5.15.171 (Vijayendra Suman)
- mac80211: always have ieee80211_sta_restart() (Johannes Berg)
- vt: prevent kernel-infoleak in con_font_get() (Jeongjun Park)
- drm/i915: Fix potential context UAFs (Rob Clark)
- Revert 'drm/mipi-dsi: Set the fwnode for mipi_dsi_device' (Jason-JH.Lin)
- mm: shmem: fix data-race in shmem_getattr() (Jeongjun Park) [Orabug: 37268580] {CVE-2024-50228}
- wifi: iwlwifi: mvm: fix 6 GHz scan construction (Johannes Berg) [Orabug: 37304734] {CVE-2024-53055}
- nilfs2: fix kernel bug due to missing clearing of checked flag (Ryusuke Konishi) [Orabug: 37268588] {CVE-2024-50230}
- x86/bugs: Use code segment selector for VERW operand (Pawan Gupta) [Orabug: 37227383] {CVE-2024-50072}
- ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (Edward Adam Davis) [Orabug: 37268563] {CVE-2024-50218}
- mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves (Matt Fleming) [Orabug: 37268568] {CVE-2024-50219}
- mm/page_alloc: explicitly define how __GFP_HIGH non-blocking allocations accesses reserves (Mel Gorman)
- mm/page_alloc: explicitly define what alloc flags deplete min reserves (Mel Gorman)
- mm/page_alloc: explicitly record high-order atomic allocations in alloc_flags (Mel Gorman)
- mm/page_alloc: treat RT tasks similar to __GFP_HIGH (Mel Gorman)
- mm/page_alloc: rename ALLOC_HIGH to ALLOC_MIN_RESERVE (Mel Gorman)
- mm/page_alloc: split out buddy removal code from rmqueue into separate helper (Mel Gorman)
- mm/page_alloc: fix tracepoint mm_page_alloc_zone_locked() (Wonhyuk Yang)
- mm/page_alloc: call check_new_pages() while zone spinlock is not held (Eric Dumazet)
- riscv: Remove duplicated GET_RM (Chunyan Zhang)
- riscv: Remove unused GENERATING_ASM_OFFSETS (Chunyan Zhang)
- riscv: Use '%u' to format the output of 'cpu' (WangYuli)
- riscv: efi: Set NX compat flag in PE/COFF header (Heinrich Schuchardt)
- riscv: vdso: Prevent the compiler from inserting calls to memset() (Alexandre Ghiti)
- nilfs2: fix potential deadlock with newly created symlinks (Ryusuke Konishi) [Orabug: 37268584] {CVE-2024-50229}
- iio: light: veml6030: fix microlux value calculation (Javier Carrasco)
- iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr() (Zicheng Qu) [Orabug: 37268595] {CVE-2024-50232}
- staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() (Zicheng Qu) [Orabug: 37268597] {CVE-2024-50233}
- wifi: iwlegacy: Clear stale interrupts before resuming device (Ville Syrjala) [Orabug: 37268602] {CVE-2024-50234}
- wifi: ath10k: Fix memory leak in management tx (Manikanta Pubbisetty) [Orabug: 37268610] {CVE-2024-50236}
- wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (Felix Fietkau) [Orabug: 37268613] {CVE-2024-50237}
- xhci: Use pm_runtime_get to prevent RPM on unsupported systems (Basavaraj Natikar)
- xhci: Fix Link TRB DMA in command ring stopped completion event (Faisal Hassan)
- usb: typec: fix unreleased fwnode_handle in typec_port_register_altmodes() (Javier Carrasco)
- usb: phy: Fix API devm_usb_put_phy() can not release the phy (Zijun Hu)
- usbip: tools: Fix detach_port() invalid port error path (Zongmin Zhou)
- misc: sgi-gru: Don't disable preemption in GRU driver (Dimitri Sivanich)
- net: amd: mvme147: Fix probe banner message (Daniel Palmer)
- scsi: scsi_transport_fc: Allow setting rport state to current state (Benjamin Marzinski)
- fs/ntfs3: Additional check in ni_clear() (Konstantin Komarov) [Orabug: 37268638] {CVE-2024-50244}
- fs/ntfs3: Fix possible deadlock in mi_read (Konstantin Komarov) [Orabug: 37268644] {CVE-2024-50245}
- fs/ntfs3: Fix warning possible deadlock in ntfs_set_state (Konstantin Komarov)
- fs/ntfs3: Check if more than chunk-size bytes are written (Andrew Ballance) [Orabug: 37268655] {CVE-2024-50247}
- firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() (Xiongfeng Wang)
- netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (Pablo Neira Ayuso) [Orabug: 37268670] {CVE-2024-50251}
- net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension (Benoit Monin)
- netfilter: Fix use-after-free in get_info() (Dong Chenchen) [Orabug: 37268689] {CVE-2024-50257}
- bpf: Fix out-of-bounds write in trie_get_next_key() (Byeonguk Jeong) [Orabug: 37268702] {CVE-2024-50262}
- netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (Zichen Xie) [Orabug: 37268697] {CVE-2024-50259}
- net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (Pedro Tammela) [Orabug: 37304740] {CVE-2024-53057}
- net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (Furong Xu) [Orabug: 37304745] {CVE-2024-53058}
- ASoC: cs42l51: Fix some error handling paths in cs42l51_probe() (Christophe JAILLET)
- wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() (Daniel Gabay) [Orabug: 37304749] {CVE-2024-53059}
- wifi: iwlwifi: mvm: disconnect station vifs if recovery failed (Emmanuel Grumbach)
- mac80211: Add support to trigger sta disconnect on hardware restart (Youghandhar Chintala)
- mac80211: do drv_reconfig_complete() before restarting all (Johannes Berg)
- RDMA/bnxt_re: synchronize the qp-handle table array (Selvin Xavier)
- RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down (Patrisious Haddad)
- RDMA/cxgb4: Dump vendor specific QP details (Leon Romanovsky)
- wifi: brcm80211: BRCM_TRACING should depend on TRACING (Geert Uytterhoeven)
- wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys (Felix Fietkau)
- mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING (Geert Uytterhoeven)
- cgroup: Fix potential overflow issue when checking max_depth (Xiu Jianfeng)
- ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context (Koba Ko) [Orabug: 37264072] {CVE-2024-50141}
- ACPI: PRM: Change handler_addr type to void pointer (Sudeep Holla)
- ACPI: PRM: Remove unnecessary blank lines (Aubrey Li)
- ksmbd: fix user-after-free from session log off (Namjae Jeon) [Orabug: 37227413] {CVE-2024-50086}
- selftests/mm: fix incorrect buffer-&gt;mirror size in hmm2 double_map test (Donet Tom)
- LTS version: v5.15.170 (Vijayendra Suman)
- xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [Orabug: 37264074] {CVE-2024-50142}
- ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() (Zichen Xie) [Orabug: 37252324] {CVE-2024-50103}
- net: phy: dp83822: Fix reset pin definitions (Michel Alex)
- serial: protect uart_port_dtr_rts() in uart_shutdown() too (Jiri Slaby (SUSE))
- selinux: improve error checking in sel_write_load() (Paul Moore)
- hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event (Haiyang Zhang)
- xfrm: fix one more kernel-infoleak in algo dumping (Petr Vaganov) [Orabug: 37252349] {CVE-2024-50110}
- ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 (Jose Relvas)
- KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (Sean Christopherson) [Orabug: 37252372] {CVE-2024-50115}
- openat2: explicitly return -E2BIG for (usize &gt; PAGE_SIZE) (Aleksa Sarai)
- nilfs2: fix kernel bug due to missing clearing of buffer delay flag (Ryusuke Konishi) [Orabug: 37252377] {CVE-2024-50116}
- ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue (Shubham Panwar)
- ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] (Christian Heusel)
- drm/amd: Guard against bad data for ATIF ACPI method (Mario Limonciello) [Orabug: 37252383] {CVE-2024-50117}
- btrfs: zoned: fix zone unusable accounting for freed reserved extent (Naohiro Aota)
- ALSA: hda/realtek: Update default depop procedure (Kailang Yang)
- ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (Andrey Shumilin) [Orabug: 37264274] {CVE-2024-50205}
- bpf,perf: Fix perf_event_detach_bpf_prog error handling (Jiri Olsa)
- posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() (Jinjie Ruan) [Orabug: 37320233] {CVE-2024-50210}
- r8169: avoid unsolicited interrupts (Heiner Kallweit)
- net: sched: fix use-after-free in taprio_change() (Dmitry Antipov) [Orabug: 37252407] {CVE-2024-50127}
- net: wwan: fix global oob in wwan_rtnl_policy (Lin Ma) [Orabug: 37252410] {CVE-2024-50128}
- net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x (Peter Rashleigh)
- net: plip: fix break; causing plip to never transmit (Jakub Boehm)
- be2net: fix potential memory leak in be_xmit() (Wang Hai) [Orabug: 37264143] {CVE-2024-50167}
- net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() (Wang Hai) [Orabug: 37264149] {CVE-2024-50168}
- xfrm: respect ip protocols rules criteria when performing dst lookups (Eyal Birger)
- xfrm: extract dst lookup parameters into a struct (Eyal Birger)
- tracing: Consider the NULL character when validating the event length (Leo Yan) [Orabug: 37252415] {CVE-2024-50131}
- platform/x86: dell-sysman: add support for alienware products (Crag Wang)
- ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string (Alexey Klimov)
- arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (junhua huang)
- platform/x86: dell-wmi: Ignore suspend notifications (Armin Wolf)
- udf: fix uninit-value use in udf_get_fileshortad (Gianfranco Trad) [Orabug: 37264080] {CVE-2024-50143}
- arm64: Force position-independent veneers (Mark Rutland)
- ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit (Shengjiu Wang)
- ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values (Alexey Klimov)
- drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA (Hans de Goede) [Orabug: 37252420] {CVE-2024-50134}
- exec: don't WARN for racy path_noexec check (Mateusz Guzik) [Orabug: 37206344] {CVE-2024-50010}
- XHCI: Separate PORT and CAPs macros into dedicated file (Frank Li)
- usb: gadget: Add function wakeup support (Elson Roy Serrao)
- KVM: s390: gaccess: Check if guest address is in memslot (Nico Boehr)
- KVM: s390: gaccess: Cleanup access to guest pages (Janis Schoetterl-Glausch)
- KVM: s390: gaccess: Refactor access address range check (Janis Schoetterl-Glausch)
- KVM: s390: gaccess: Refactor gpa and length calculation (Janis Schoetterl-Glausch)
- arm64: probes: Fix uprobes for big-endian kernels (Mark Rutland) [Orabug: 37264236] {CVE-2024-50194}
- arm64:uprobe fix the uprobe SWBP_INSN in big-endian (junhua huang)
- Bluetooth: bnep: fix wild-memory-access in proto_unregister (Ye Bin) [Orabug: 37264096] {CVE-2024-50148}
- s390: Initialize psw mask in perf_arch_fetch_caller_regs() (Heiko Carstens)
- usb: typec: altmode should keep reference to parent (Thadeu Lima de Souza Cascardo) [Orabug: 37264102] {CVE-2024-50150}
- smb: client: fix OOBs when building SMB2_IOCTL request (Paulo Alcantara) [Orabug: 37264107] {CVE-2024-50151}
- scsi: target: core: Fix null-ptr-deref in target_alloc_device() (Wang Hai) [Orabug: 37264112] {CVE-2024-50153}
- genetlink: hold RCU in genlmsg_mcast() (Eric Dumazet)
- tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Kuniyuki Iwashima) [Orabug: 37264114] {CVE-2024-50154}
- net: systemport: fix potential memory leak in bcm_sysport_xmit() (Wang Hai) [Orabug: 37264156] {CVE-2024-50171}
- net: xilinx: axienet: fix potential memory leak in axienet_start_xmit() (Wang Hai)
- net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid (Li RongQing)
- net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() (Wang Hai)
- macsec: don't increment counters for an unrelated SA (Sabrina Dubroca)
- net: usb: usbnet: fix race in probe failure (Oliver Neukum)
- drm/msm: Allocate memory for disp snapshot with kvzalloc() (Douglas Anderson)
- drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() (Douglas Anderson) [Orabug: 37264122] {CVE-2024-50156}
- drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation (Jonathan Marek)
- RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (Bhargava Chenna Marreddy) [Orabug: 37264280] {CVE-2024-50208}
- RDMA/bnxt_re: Return more meaningful error (Kalesh AP)
- ipv4: give an IPv4 dev to blackhole_netdev (Xin Long)
- RDMA/irdma: Fix misspelling of 'accept*' (Alexander Zubkov)
- RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Anumula Murali Mohan Reddy)
- ALSA: hda/cs8409: Fix possible NULL dereference (Murad Masimov) [Orabug: 37264129] {CVE-2024-50160}
- ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin (Florian Klink)
- x86/resctrl: Avoid overflow in MB settings in bw_validate() (Martin Kletzander)
- RDMA/bnxt_re: Add a check for memory allocation (Kalesh AP) [Orabug: 37264285] {CVE-2024-50209}
- RDMA/bnxt_re: Fix incorrect AVID type in WQE structure (Saravanan Vajravel)
- bpf: devmap: provide rxq after redirect (Florian Kauer) [Orabug: 37264132] {CVE-2024-50162}
- bpf: Make sure internal and UAPI bpf_redirect flags don't overlap (Toke Hoiland-Jorgensen) [Orabug: 37264134] {CVE-2024-50163}
- LTS version: v5.15.169 (Vijayendra Suman)
- ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 (Vasiliy Kovalev)
- powerpc/mm: Always update max/min_low_pfn in mem_topology_setup() (Aneesh Kumar K.V)
- nilfs2: propagate directory read errors from nilfs_find_entry() (Ryusuke Konishi) [Orabug: 37264266] {CVE-2024-50202}
- mptcp: prevent MPC handshake on port-based signal endpoints (Paolo Abeni)
- mptcp: fallback when MPTCP opts are dropped after 1st data (Matthieu Baerts (NGI0))
- tcp: fix mptcp DSS corruption due to large pmtu xmit (Paolo Abeni) [Orabug: 37227408] {CVE-2024-50083}
- mptcp: handle consistently DSS corruption (Paolo Abeni) [Orabug: 37264210] {CVE-2024-50185}
- mptcp: track and update contiguous data status (Geliang Tang)
- irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Marc Zyngier) [Orabug: 37264231] {CVE-2024-50192}
- pinctrl: ocelot: fix system hang on level based interrupts (Sergey Matsievskiy) [Orabug: 37264246] {CVE-2024-50196}
- x86/entry_32: Clear CPU buffers after register restore in NMI return (Pawan Gupta) [Orabug: 37264234] {CVE-2024-50193}
- x86/entry_32: Do not clobber user EFLAGS.ZF (Pawan Gupta)
- x86/apic: Always explicitly disarm TSC-deadline timer (Zhang Rui)
- x86/resctrl: Annotate get_mem_config() functions as __init (Nathan Chancellor)
- USB: serial: option: add Telit FN920C04 MBIM compositions (Daniele Palmas)
- USB: serial: option: add support for Quectel EG916Q-GL (Benjamin B. Frost)
- xhci: Mitigate failed set dequeue pointer commands (Mathias Nyman)
- xhci: Fix incorrect stream context type macro (Mathias Nyman)
- Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 (Luiz Augusto von Dentz)
- Bluetooth: Remove debugfs directory on module init failure (Aaron Thompson)
- iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig (Javier Carrasco)
- iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig (Javier Carrasco)
- iio: light: opt3001: add missing full-scale range value (Emil Gedenryd)
- iio: light: veml6030: fix IIO device retrieval from embedded device (Javier Carrasco) [Orabug: 37264254] {CVE-2024-50198}
- iio: light: veml6030: fix ALS sensor resolution (Javier Carrasco)
- iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() (Christophe JAILLET)
- iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig (Javier Carrasco)
- iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig (Javier Carrasco)
- iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig (Javier Carrasco)
- iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig (Javier Carrasco)
- drm/vmwgfx: Handle surface check failure correctly (Nikolay Kuratov)
- drm/radeon: Fix encoder-&gt;possible_clones (Ville Syrjala) [Orabug: 37264263] {CVE-2024-50201}
- io_uring/sqpoll: close race on waiting for sqring entries (Jens Axboe)
- blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Omar Sandoval) [Orabug: 37227403] {CVE-2024-50082}
- x86/bugs: Do not use UNTRAIN_RET with IBPB on entry (Johannes Wikner)
- x86/bugs: Skip RSB fill at VMEXIT (Johannes Wikner)
- x86/entry: Have entry_ibpb() invalidate return predictions (Johannes Wikner)
- x86/cpufeatures: Add a IBPB_NO_RET BUG flag (Johannes Wikner)
- x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET (Jim Mattson)
- KVM: s390: Change virtual to physical address access in diag 0x258 handler (Michael Mueller)
- s390/sclp_vt220: Convert newlines to CRLF instead of LFCR (Thomas Weissschuh)
- iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices (Lu Baolu) [Orabug: 37252321] {CVE-2024-50101}
- io_uring/sqpoll: do not put cpumask on stack (Felix Moessbauer)
- io_uring/sqpoll: retain test for whether the CPU is valid (Jens Axboe)
- io_uring/sqpoll: do not allow pinning outside of cpuset (Felix Moessbauer)
- drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (Wachowski, Karol)
- KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (Breno Leitao) [Orabug: 36835836] {CVE-2024-40953}
- dm-crypt, dm-verity: disable tasklets (Mikulas Patocka)
- wifi: mac80211: fix potential key use-after-free (Johannes Berg)
- secretmem: disable memfd_secret() if arch cannot set direct map (Patrick Roy) [Orabug: 37264195] {CVE-2024-50182}
- mm/swapfile: skip HugeTLB pages for unuse_vma (Liu Shixin) [Orabug: 37264256] {CVE-2024-50199}
- fat: fix uninitialized variable (OGAWA Hirofumi)
- irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 (Nianyao Tang)
- net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY (Oleksij Rempel)
- arm64: probes: Fix simulate_ldr*_literal() (Mark Rutland)
- arm64: probes: Remove broken LDR (literal) uprobe support (Mark Rutland) [Orabug: 37252316] {CVE-2024-50099}
- posix-clock: Fix missing timespec64 check in pc_clock_settime() (Jinjie Ruan) [Orabug: 37264241] {CVE-2024-50195}
- net: enetc: add missing static descriptor and inline keyword (Wei Fang)
- net: enetc: remove xdp_drops statistic from enetc_xdp_drop() (Wei Fang)
- udf: Fix bogus checksum computation in udf_rename() (Jan Kara) [Orabug: 37320204] {CVE-2024-43845}
- udf: Don't return bh from udf_expand_dir_adinicb() (Jan Kara)
- udf: Handle error when expanding directory (Jan Kara)
- udf: Remove old directory iteration code (Jan Kara)
- udf: Convert udf_link() to new directory iteration code (Jan Kara)
- udf: Convert udf_mkdir() to new directory iteration code (Jan Kara)
- udf: Convert udf_add_nondir() to new directory iteration (Jan Kara)
- udf: Implement adding of dir entries using new iteration code (Jan Kara)
- udf: Convert udf_unlink() to new directory iteration code (Jan Kara)
- udf: Convert udf_rmdir() to new directory iteration code (Jan Kara)
- udf: Convert empty_dir() to new directory iteration code (Jan Kara)
- udf: Convert udf_get_parent() to new directory iteration code (Jan Kara)
- udf: Convert udf_lookup() to use new directory iteration code (Jan Kara)
- udf: Convert udf_readdir() to new directory iteration (Jan Kara)
- udf: Convert udf_rename() to new directory iteration code (Jan Kara)
- udf: Provide function to mark entry as deleted using new directory iteration code (Jan Kara)
- udf: Implement searching for directory entry using new iteration code (Jan Kara)
- udf: Move udf_expand_dir_adinicb() to its callsite (Jan Kara)
- udf: Convert udf_expand_dir_adinicb() to new directory iteration (Jan Kara)
- udf: New directory iteration code (Jan Kara)
- ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 (Vasiliy Kovalev)

[5.15.0-303.168.3]
- ACPI: CPPC: Make rmw_lock a raw_spin_lock (Pierre Gondois) [Orabug: 37268714] {CVE-2024-50249}
- net: usb: usbnet: fix name regression (Oliver Neukum)
- mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (Matthieu Baerts (NGI0))
- parport: Proper fix for array out-of-bounds access (Takashi Iwai) [Orabug: 37227435] {CVE-2024-50074}
- netfilter: xtables: fix typo causing some targets not to load on IPv6 (Pablo Neira Ayuso)
- block, bfq: fix procress reference leakage for bfqq in merge chain (Yu Kuai)
- ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() (Ido Schimmel) [Orabug: 37304697] {CVE-2024-53042}
- usb: dwc3: core: Fix system suspend on TI AM62 platforms (Roger Quadros)
- Revert 'driver core: Fix uevent_show() vs driver detach race' (Greg Kroah-Hartman)
- jfs: Fix sanity check in dbMount (Dave Kleikamp)
- octeontx2-af: Fix potential integer overflows on integer shifts (Colin Ian King)
- gtp: allow -1 to be specified as file description from userspace (Pablo Neira Ayuso)
- scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (Justin Tee)  [Orabug: 37070103]  {CVE-2024-43816}
- blk-cgroup: Properly propagate the iostat update up the hierarchy (Waiman Long)  [Orabug: 37264361]
- blk-cgroup: fix list corruption from reorder of WRITE -&gt;lqueued (Ming Lei)  [Orabug: 37264361] {CVE-2024-38384}
- blk-cgroup: fix list corruption from resetting io stat (Ming Lei)  [Orabug: 37264361] {CVE-2024-38663}
- blk-cgroup: Flush stats before releasing blkcg_gq (Ming Lei)  [Orabug: 37264361]
- blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() (Waiman Long)  [Orabug: 37264361]
- blk-cgroup: don't update io stat for root cgroup (Ming Lei)  [Orabug: 37264361]
- blk-cgroup: Optimize blkcg_rstat_flush() (Waiman Long)  [Orabug: 37264361]
- blk-cgroup: Return -ENOMEM directly in blkcg_css_alloc() error path (Waiman Long)  [Orabug: 37264361]
- vfio/iommu_type1: replace kfree with kvfree (Jiacheng Shi)  [Orabug: 37263362]
- i2c: i801: Add support for Intel Birch Stream SoC (Jarkko Nikula)  [Orabug: 37249533]
- nvme: fix deadlock between reset and scan (Bitao Hu)  [Orabug: 37244604]
- virt: sevguest: Add TSM_REPORTS support for SNP_GET_EXT_REPORT (Dan Williams)  [Orabug: 37070016]
- virt: sevguest: Prep for kernel internal get_ext_report() (Dan Williams)  [Orabug: 37070016]
- configfs-tsm: Introduce a shared ABI for attestation reports (Dan Williams)  [Orabug: 37070016]
- virt: coco: Add a coco/Makefile and coco/Kconfig (Dan Williams)  [Orabug: 37070016]
- virt: sevguest: Fix passing a stack buffer as a scatterlist target (Dan Williams)  [Orabug: 37070016]
- x86/sev: Change snp_guest_issue_request()'s fw_err argument (Dionna Glaze)  [Orabug: 37070016]
- crypto: ccp - Name -1 return value as SEV_RET_NO_FW_CALL (Peter Gonda)  [Orabug: 37070016]
- virt/coco/sev-guest: Double-buffer messages (Dionna Glaze)  [Orabug: 37070016]
- virt/coco/sev-guest: Add throttling awareness (Dionna Glaze)  [Orabug: 37070016]
- virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case (Borislav Petkov (AMD))  [Orabug: 37070016]
- virt/coco/sev-guest: Do some code style cleanups (Borislav Petkov (AMD))  [Orabug: 37070016]
- virt/coco/sev-guest: Carve out the request issuing logic into a helper (Borislav Petkov (AMD))  [Orabug: 37070016]
- virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request() (Borislav Petkov (AMD))  [Orabug: 37070016]
- virt/coco/sev-guest: Simplify extended guest request handling (Borislav Petkov (AMD))  [Orabug: 37070016]
- virt/coco/sev-guest: Check SEV_SNP attribute at probe time (Borislav Petkov (AMD))  [Orabug: 37070016]
- x86/sev: Mark snp_abort() noreturn (Borislav Petkov)  [Orabug: 37070016]
- kbuild: Drop -Wdeclaration-after-statement (Peter Zijlstra)  [Orabug: 37070016]
- apparmor: Free up __cleanup() name (Peter Zijlstra)  [Orabug: 37070016]
- fwctl: Expand adaption of code for UEK7 (Liam Merwick)  [Orabug: 37070016]
- mm/slab: Add __free() support for kvfree (Dan Williams)  [Orabug: 37070016]
- mm: move kvmalloc-related functions to slab.h (Matthew Wilcox (Oracle))  [Orabug: 37070016]
- x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Tom Lendacky)  [Orabug: 37070016]
- iommu/amd: Do not identity map v2 capable device when snp is enabled (Vasant Hegde)  [Orabug: 37070016]
- virt: sevguest: Add CONFIG_CRYPTO dependency (Arnd Bergmann)  [Orabug: 37070016]
- virt/sev-guest: Remove unnecessary free in init_crypto() (Rafael Mendonca)  [Orabug: 37070016]
- virt/sev-guest: Add a MODULE_ALIAS (Cole Robinson)  [Orabug: 37070016]
- virt/sev-guest: Return -EIO if certificate buffer is not large enough (Tom Lendacky)  [Orabug: 37070016]
- virt/sev-guest: Prevent IV reuse in the SNP guest driver (Peter Gonda)  [Orabug: 37070016]
- x86/compressed/64: Add identity mappings for setup_data entries (Michael Roth)  [Orabug: 37070016]
- x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Borislav Petkov (AMD))  [Orabug: 37070016]
- x86/sev: Use the GHCB protocol when available for SNP CPUID requests (Tom Lendacky)  [Orabug: 37070016]
- x86/boot: Fix the setup data types max limit (Borislav Petkov)  [Orabug: 37070016]
- x86/sev: Don't use cc_platform_has() for early SEV-SNP calls (Tom Lendacky)  [Orabug: 37070016]
- x86/sev: Fix calculation of end address based on number of pages (Tom Lendacky)  [Orabug: 37070016]
- x86/sev: Fix kernel crash due to late update to read-only ghcb_version (Ashwin Dayanand Kamat)  [Orabug: 37070016]
- x86/sev: Add SEV-SNP guest feature negotiation support (Nikunj A Dadhania)  [Orabug: 37070016]
- Revert 'x86/sev: Expose sev_es_ghcb_hv_call() for use by HyperV' (Borislav Petkov)  [Orabug: 37070016]
- x86/boot: Don't propagate uninitialized boot_params-&gt;cc_blob_address (Michael Roth)  [Orabug: 37070016]
- KVM: SVM: Only dump VMSA to klog at KERN_DEBUG level (Peter Gonda)  [Orabug: 37070016]
- KVM: SVM: Dump Virtual Machine Save Area (VMSA) to klog (Jarkko Sakkinen)  [Orabug: 37070016]
- KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors (Sean Christopherson)  [Orabug: 37070016]
- iommu/amd: Add support for AVIC when SNP is enabled (Suravee Suthikulpanit)  [Orabug: 37070016]
- iommu/amd: Do not support IOMMUv2 APIs when SNP is enabled (Suravee Suthikulpanit)  [Orabug: 37070016]
- iommu/amd: Do not support IOMMU_DOMAIN_IDENTITY after SNP is enabled (Suravee Suthikulpanit)  [Orabug: 37070016]
- iommu/amd: Set translation valid bit only when IO page tables are in use (Suravee Suthikulpanit)  [Orabug: 37070016]
- iommu/amd: Introduce function to check and enable SNP (Brijesh Singh)  [Orabug: 37070016]
- iommu/amd: Globally detect SNP support (Suravee Suthikulpanit)  [Orabug: 37070016]
- iommu/amd: Process all IVHDs before enabling IOMMU features (Suravee Suthikulpanit)  [Orabug: 37070016]
- iommu/amd: Introduce global variable for storing common EFR and EFR2 (Suravee Suthikulpanit)  [Orabug: 37070016]
- iommu/amd: Introduce Support for Extended Feature 2 Register (Suravee Suthikulpanit)  [Orabug: 37070016]
- x86/sev: Remove duplicated assignment to variable info (Colin Ian King)  [Orabug: 37070016]
- x86/sev: Fix address space sparse warning (Borislav Petkov)  [Orabug: 37070016]
- x86/sev: Get the AP jump table address from secrets page (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Add missing __init annotations to SEV init routines (Michael Roth)  [Orabug: 37070016]
- crypto: ccp - Log when resetting PSP SEV state (Peter Gonda)  [Orabug: 37070016]
- virt: sev-guest: Pass the appropriate argument type to iounmap() (Tom Lendacky)  [Orabug: 37070016]
- virt: sevguest: Rename the sevguest dir and files to sev-guest (Tom Lendacky)  [Orabug: 37070016]
- virt: sevguest: Change driver name to reflect generic SEV support (Tom Lendacky)  [Orabug: 37070016]
- x86/boot: Put globals that are accessed early into the .data section (Michael Roth)  [Orabug: 37070016]
- virt: sevguest: Fix bool function returning negative value (Haowen Bai)  [Orabug: 37070016]
- virt: sevguest: Fix return value check in alloc_shared_pages() (Yang Yingliang)  [Orabug: 37070016]
- x86/sev-es: Replace open-coded hlt-loop with sev_es_terminate() (Peter Gonda)  [Orabug: 37070016]
- virt: sevguest: Add documentation for SEV-SNP CPUID Enforcement (Michael Roth)  [Orabug: 37070016]
- virt: sevguest: Add support to get extended report (Brijesh Singh)  [Orabug: 37070016]
- virt: sevguest: Add support to derive key (Brijesh Singh)  [Orabug: 37070016]
- virt: Add SEV-SNP guest driver (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Register SEV-SNP guest request platform device (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Provide support for SNP guest request NAEs (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Add a sev= cmdline option (Michael Roth)  [Orabug: 37070016]
- x86/sev: Use firmware-validated CPUID for SEV-SNP guests (Michael Roth)  [Orabug: 37070016]
- x86/sev: Add SEV-SNP feature detection/setup (Michael Roth)  [Orabug: 37070016]
- x86/compressed/64: Add identity mapping for Confidential Computing blob (Michael Roth)  [Orabug: 37070016]
- x86/compressed: Use firmware-validated CPUID leaves for SEV-SNP guests (Michael Roth)  [Orabug: 37070016]
- x86/compressed: Add SEV-SNP feature detection/setup (Michael Roth)  [Orabug: 37070016]
- x86/boot: Add a pointer to Confidential Computing blob in bootparams (Michael Roth)  [Orabug: 37070016]
- x86/compressed/64: Add support for SEV-SNP CPUID table in #VC handlers (Michael Roth)  [Orabug: 37070016]
- x86/sev: Move MSR-based VMGEXITs for CPUID to helper (Michael Roth)  [Orabug: 37070016]
- KVM: x86: Move lookup of indexed CPUID leafs to helper (Michael Roth)  [Orabug: 37070016]
- x86/boot: Add Confidential Computing type to setup_data (Brijesh Singh)  [Orabug: 37070016]
- x86/compressed/acpi: Move EFI kexec handling into common code (Michael Roth)  [Orabug: 37070016]
- x86/compressed/acpi: Move EFI vendor table lookup to helper (Michael Roth)  [Orabug: 37070016]
- x86/compressed/acpi: Move EFI config table lookup to helper (Michael Roth)  [Orabug: 37070016]
- x86/compressed/acpi: Move EFI system table lookup to helper (Michael Roth)  [Orabug: 37070016]
- x86/head/64: Re-enable stack protection (Michael Roth)  [Orabug: 37070016]
- x86/sev: Use SEV-SNP AP creation to start secondary CPUs (Tom Lendacky)  [Orabug: 37070016]
- x86/sev: Remove do_early_exception() forward declarations (Borislav Petkov)  [Orabug: 37070016]
- x86/mm: Validate memory when changing the C-bit (Brijesh Singh)  [Orabug: 37070016]
- x86/mm/cpa: Generalize __set_memory_enc_pgtable() (Brijesh Singh)  [Orabug: 37070016]
- x86/kernel: Validate ROM memory before accessing when SEV-SNP is active (Brijesh Singh)  [Orabug: 37070016]
- x86/kernel: Mark the .bss..decrypted section as shared in the RMP table (Brijesh Singh)  [Orabug: 37070016]
- x86/head64: Add missing __head annotation to sme_postprocess_startup() (Marco Bonelli)  [Orabug: 37070016]
- x86/head64: Carve out the guest encryption postprocessing into a helper (Borislav Petkov)  [Orabug: 37070016]
- x86/sev: Add helper for validating pages in early enc attribute changes (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Register GHCB memory when SEV-SNP is active (Brijesh Singh)  [Orabug: 37070016]
- x86/compressed: Register GHCB memory when SEV-SNP is active (Brijesh Singh)  [Orabug: 37070016]
- x86/compressed: Add helper for validating pages in the decompression stage (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Check the VMPL level (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Add a helper for the PVALIDATE instruction (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Check SEV-SNP features support (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Save the negotiated GHCB version (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Define the Linux-specific guest termination reasons (Brijesh Singh)  [Orabug: 37070016]
- x86/mm: Extend cc_attr to include AMD SEV-SNP (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Detect/setup SEV/SME features earlier in boot (Michael Roth)  [Orabug: 37070016]
- x86/compressed/64: Detect/setup SEV/SME features earlier during boot (Michael Roth)  [Orabug: 37070016]
- KVM: SVM: Update the SEV-ES save area mapping (Tom Lendacky)  [Orabug: 37070016]
- KVM: SVM: Create a separate mapping for the GHCB save area (Tom Lendacky)  [Orabug: 37070016] [Orabug: 37070016]
- KVM: SVM: Create a separate mapping for the SEV-ES save area (Tom Lendacky)  [Orabug: 37070016]
- KVM: SVM: Define sev_features and VMPL field in the VMSA (Brijesh Singh)  [Orabug: 37070016]
- x86/sev: Move common memory encryption code to mem_encrypt.c (Kirill A. Shutemov)  [Orabug: 37070016]
- x86/sev: Rename mem_encrypt.c to mem_encrypt_amd.c (Kuppuswamy Sathyanarayanan)  [Orabug: 37070016]
- x86/sev: Get rid of excessive use of defines (Borislav Petkov)  [Orabug: 37070016]
- x86/sev: Shorten GHCB terminate macro names (Brijesh Singh)  [Orabug: 37070016]
- x86/coco: Add API to handle encryption mask (Kirill A. Shutemov)  [Orabug: 37070016]
- x86/coco: Explicitly declare type of confidential computing platform (Kirill A. Shutemov)  [Orabug: 37070016]
- x86/hyperv: Initialize GHCB page in Isolation VM (Tianyu Lan)  [Orabug: 37070016]
- x86/cc: Move arch/x86/{kernel/cc_platform.c =&gt; coco/core.c} (Kirill A. Shutemov)  [Orabug: 37070016]
- x86/hyper-v: Add hyperv Isolation VM check in the cc_platform_has() (Tianyu Lan)  [Orabug: 37070016]
- crypto: ccp - Add SEV_INIT_EX support (David Rientjes)  [Orabug: 37070016]
- crypto: ccp - Add psp_init_on_probe module parameter (Peter Gonda)  [Orabug: 37070016]
- crypto: ccp - Add SEV_INIT rc error logging on init (Peter Gonda)  [Orabug: 37070016]
- KVM: SVM: Hide SEV migration lockdep goo behind CONFIG_PROVE_LOCKING (Sean Christopherson)  [Orabug: 37070016]
- KVM: SVM: Skip VMSA init in sev_es_init_vmcb() if pointer is NULL (Sean Christopherson)  [Orabug: 37070016]
- KVM: SEV: Init target VMCBs in sev_migrate_from (Peter Gonda)  [Orabug: 37070016]
- KVM, SEV: Add KVM_EXIT_SHUTDOWN metadata for SEV-ES (Peter Gonda)  [Orabug: 37070016]
- KVM: SEV: Mark nested locking of vcpu-&gt;lock (Peter Gonda)  [Orabug: 37070016]
- KVM: SVM: Simplify and harden helper to flush SEV guest page(s) (Sean Christopherson)  [Orabug: 37070016]
- KVM: SEV: Add cond_resched() to loop in sev_clflush_pages() (Peter Gonda)  [Orabug: 37070016]
- KVM: SEV: Allow SEV intra-host migration of VM with mirrors (Peter Gonda)  [Orabug: 37070016]
- KVM: SVM: improve split between svm_prepare_guest_switch and sev_es_prepare_guest_switch (Paolo Bonzini)  [Orabug: 37070016]
- selftests: KVM: sev_migrate_tests: Add mirror command tests (Peter Gonda)  [Orabug: 37070016]
- selftests: KVM: sev_migrate_tests: Fix sev_ioctl() (Peter Gonda)  [Orabug: 37070016]
- selftests: KVM: sev_migrate_tests: Fix test_sev_mirror() (Peter Gonda)  [Orabug: 37070016]
- KVM: SEV: Mark nested locking of kvm-&gt;lock (Wanpeng Li)  [Orabug: 37070016]
- KVM: SVM: Do not terminate SEV-ES guests on GHCB validation failure (Tom Lendacky)  [Orabug: 37070016]
- KVM: SEV: Fall back to vmalloc for SEV-ES scratch area if necessary (Sean Christopherson)  [Orabug: 37070016]
- KVM: SEV: accept signals in sev_lock_two_vms (Paolo Bonzini)  [Orabug: 37070016]
- KVM: SEV: do not take kvm-&gt;lock when destroying (Paolo Bonzini)  [Orabug: 37070016]
- KVM: SEV: Prohibit migration of a VM that has mirrors (Paolo Bonzini)  [Orabug: 37070016]
- KVM: SEV: Do COPY_ENC_CONTEXT_FROM with both VMs locked (Paolo Bonzini)  [Orabug: 37070016]
- selftests: sev_migrate_tests: add tests for KVM_CAP_VM_COPY_ENC_CONTEXT_FROM (Paolo Bonzini)  [Orabug: 37070016]
- KVM: SEV: move mirror status to destination of KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM (Paolo Bonzini)  [Orabug: 37070016]
- KVM: SEV: cleanup locking for KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM (Paolo Bonzini)  [Orabug: 37070016]
- KVM: SEV: do not use list_replace_init on an empty list (Paolo Bonzini)  [Orabug: 37070016]
- selftests: sev_migrate_tests: free all VMs (Paolo Bonzini)  [Orabug: 37070016]
- selftests: fix check for circular KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM (Paolo Bonzini)  [Orabug: 37070016]
- KVM: SEV: Fix typo in and tweak name of cmd_allowed_from_miror() (Sean Christopherson)  [Orabug: 37070016]
- KVM: SEV: Drop a redundant setting of sev-&gt;asid during initialization (Sean Christopherson)  [Orabug: 37070016]
- KVM: SEV: Set sev_info.active after initial checks in sev_guest_init() (Sean Christopherson)  [Orabug: 37070016]
- KVM: SEV: unify cgroup cleanup code for svm_vm_migrate_from (Paolo Bonzini)  [Orabug: 37070016]
- selftest: KVM: Add intra host migration tests (Peter Gonda)  [Orabug: 37070016]
- KVM: selftests: Use pattern matching in .gitignore (Sean Christopherson)  [Orabug: 37070016]
- selftest: KVM: Add open sev dev helper (Peter Gonda)  [Orabug: 37070016]
- x86/kvm: Add guest support for detecting and enabling SEV Live Migration feature. (Ashish Kalra)  [Orabug: 37070016]
- EFI: Introduce the new AMD Memory Encryption GUID. (Ashish Kalra)  [Orabug: 37070016]
- mm: x86: Invoke hypercall when page encryption status is changed (Brijesh Singh)  [Orabug: 37070016]
- x86/kvm: Add AMD SEV specific Hypercall3 (Brijesh Singh)  [Orabug: 37070016]
- KVM: SEV: Add support for SEV-ES intra host migration (Peter Gonda)  [Orabug: 37070016]
- KVM: SEV: Add support for SEV intra host migration (Peter Gonda)  [Orabug: 37070016]
- KVM: SEV: provide helpers to charge/uncharge misc_cg (Paolo Bonzini)  [Orabug: 37070016]
- KVM: SEV: Refactor out sev_es_state struct (Peter Gonda)  [Orabug: 37070016]
- x86/sev: Expose sev_es_ghcb_hv_call() for use by HyperV (Tianyu Lan)  [Orabug: 37070016]
- x86/sev: Allow #VC exceptions on the VC2 stack (Joerg Roedel)  [Orabug: 37070016]
- KVM: generalize 'bugged' VM to 'dead' VM (Paolo Bonzini)  [Orabug: 37070016]
- x86/sev: Carve out HV call's return value verification (Borislav Petkov)  [Orabug: 37070016]
- KVM: Free new dirty bitmap if creating a new memslot fails (Sean Christopherson)  [Orabug: 37070016]
- KVM: Fix comments that refer to the non-existent install_new_memslots() (Jun Miao)  [Orabug: 37070016]
- KVM: x86: Retry page fault if MMU reload is pending and root has no sp (Sean Christopherson)  [Orabug: 37070016]
- KVM: x86/mmu: Fix an sign-extension bug with mmu_seq that hangs vCPUs (Sean Christopherson)  [Orabug: 37070016]
- KVM: Dynamically allocate 'new' memslots from the get-go (Sean Christopherson)  [Orabug: 37070016]
- KVM: Wait 'til the bitter end to initialize the 'new' memslot (Sean Christopherson)  [Orabug: 37070016]
- KVM: Optimize overlapping memslots check (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: Optimize gfn lookup in kvm_zap_gfn_range() (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: Call kvm_arch_flush_shadow_memslot() on the old slot in kvm_invalidate_memslot() (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: Keep memslots in tree-based structures instead of array-based ones (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: s390: Introduce kvm_s390_get_gfn_end() (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: s390: Add a routine for setting userspace CPU state (Eric Farman)  [Orabug: 37070016]
- KVM: Use interval tree to do fast hva lookup in memslots (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: Resolve memslot ID via a hash table instead of via a static array (Maciej S. Szmigiero)  [Orabug: 37070016]
- Revert 'kvm: fix possible spectre gadgets in include/linux/kvm_host.h' (Liam Merwick)  [Orabug: 37070016]
- KVM: Move WARN on invalid memslot index to update_memslots() (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: Integrate gfn_to_memslot_approx() into search_memslots() (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: x86: Use nr_memslot_pages to avoid traversing the memslots array (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: x86: Don't call kvm_mmu_change_mmu_pages() if the count hasn't changed (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: Don't make a full copy of the old memslot in __kvm_set_memory_region() (Sean Christopherson)  [Orabug: 37070016]
- KVM: s390: Skip gfn/size sanity checks on memslot DELETE or FLAGS_ONLY (Sean Christopherson)  [Orabug: 37070016]
- KVM: x86: Don't assume old/new memslots are non-NULL at memslot commit (Sean Christopherson)  [Orabug: 37070016]
- KVM: Use prepare/commit hooks to handle generic memslot metadata updates (Sean Christopherson)  [Orabug: 37070016]
- KVM: Stop passing kvm_userspace_memory_region to arch memslot hooks (Sean Christopherson)  [Orabug: 37070016]
- KVM: x86: Use 'new' memslot instead of userspace memory region (Sean Christopherson)  [Orabug: 37070016]
- KVM: s390: Use 'new' memslot instead of userspace memory region (Sean Christopherson)  [Orabug: 37070016]
- KVM: PPC: Avoid referencing userspace memory region in memslot updates (Sean Christopherson)  [Orabug: 37070016]
- KVM: MIPS: Drop pr_debug from memslot commit to avoid using 'mem' (Sean Christopherson)  [Orabug: 37070016]
- KVM: arm64: Use 'new' memslot instead of userspace memory region (Sean Christopherson)  [Orabug: 37070016]
- KVM: Let/force architectures to deal with arch specific memslot data (Sean Christopherson)  [Orabug: 37070016]
- KVM: Use 'new' memslot's address space ID instead of dedicated param (Sean Christopherson)  [Orabug: 37070016]
- KVM: Resync only arch fields when slots_arch_lock gets reacquired (Maciej S. Szmigiero)  [Orabug: 37070016]
- KVM: Open code kvm_delete_memslot() into its only caller (Sean Christopherson)  [Orabug: 37070016]
- KVM: Require total number of memslot pages to fit in an unsigned long (Sean Christopherson)  [Orabug: 37070016]
- KVM: x86/mmu: Extract zapping of rmaps for gfn range to separate helper (Sean Christopherson)  [Orabug: 37070016]
- KVM: x86/mmu: Drop a redundant remote TLB flush in kvm_zap_gfn_range() (Sean Christopherson)  [Orabug: 37070016]
- KVM: x86/mmu: Retry page fault if root is invalidated by memslot update (Sean Christopherson)  [Orabug: 37070016]
- KVM: x86/mmu: Properly dereference rcu-protected TDP MMU sptep iterator (Sean Christopherson)  [Orabug: 37070016]
- KVM: x86/mmu: Don't rebuild page when the page is synced and no tlb flushing is required (Hou Wenlong)  [Orabug: 37070016]
- KVM: x86/mmu: Avoid memslot lookup in rmap_add (David Matlack)  [Orabug: 37070016]
- KVM: MMU: pass struct kvm_page_fault to mmu_set_spte (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: pass kvm_mmu_page struct to make_spte (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: set ad_disabled in TDP MMU role (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: remove unnecessary argument to mmu_set_spte (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: clean up make_spte return value (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: inline set_spte in FNAME(sync_page) (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: inline set_spte in mmu_set_spte (Paolo Bonzini)  [Orabug: 37070016]
- KVM: x86/mmu: Avoid memslot lookup in page_fault_handle_page_track (David Matlack)  [Orabug: 37070016]
- KVM: x86/mmu: Pass the memslot around via struct kvm_page_fault (David Matlack)  [Orabug: 37070016] [Orabug: 37070016]
- KVM: MMU: unify tdp_mmu_map_set_spte_atomic and tdp_mmu_set_spte_atomic_no_dirty_log (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: mark page dirty in make_spte (Paolo Bonzini)  [Orabug: 37070016]
- KVM: x86/mmu: Verify shadow walk doesn't terminate early in page faults (Sean Christopherson)  [Orabug: 37070016]
- KVM: MMU: change tracepoints arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change disallowed_hugepage_adjust() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change kvm_mmu_hugepage_adjust() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change fast_page_fault() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change tdp_mmu_map_handle_target_level() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change kvm_tdp_mmu_map() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change FNAME(fetch)() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change __direct_map() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change handle_abnormal_pfn() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change kvm_faultin_pfn() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change page_fault_handle_page_track() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change direct_page_fault() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: change mmu-&gt;page_fault() arguments to kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: Introduce struct kvm_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: MMU: pass unadulterated gpa to direct_page_fault (Paolo Bonzini)  [Orabug: 37070016]
- KVM: X86: Don't unsync pagetables when speculative (Lai Jiangshan)  [Orabug: 37070016]
- KVM: X86: Change kvm_sync_page() to return true when remote flush is needed (Lai Jiangshan)  [Orabug: 37070016]
- KVM: X86: Remove kvm_mmu_flush_or_zap() (Lai Jiangshan)  [Orabug: 37070016]
- KVM: X86: Don't flush current tlb on shadow page modification (Lai Jiangshan)  [Orabug: 37070016]
- net: mana: Fix RX buf alloc_size alignment and atomic op panic (Haiyang Zhang)  [Orabug: 37029115]  {CVE-2024-45001}
- net/mlx5: pretend 'fast unload' succeeded on Exadata systems (Gerd Rausch)  [Orabug: 37224000]
- rds: Do not invoke the transport's recv_path() while in atomic context (Hakon Bugge)  [Orabug: 36368605]

[5.15.0-303.168.2]
- Revert 'rds: ib: Make sure receives are posted before connection is up' (Gerd Rausch)  [Orabug: 37244182]
- uek-rpm/ol9/config-mips64: Align MIPS64 Crypto configs with x86_64 (Vijay Kumar)  [Orabug: 37218693]
- rds: ib: Avoid reuse of IB MRs when cleaning is in progress (Hakon Bugge)  [Orabug: 37206836]
- spec: Set CONFIG_CRYPTO_FIPS_NAME for standard &amp; embedded kernels (Jonah Palmer)  [Orabug: 37137136]
- spec: Set CONFIG_CRYPTO_FIPS_NAME for container kernels (Jonah Palmer)  [Orabug: 37137136]
- spec: Add UEK release macros for UEK7 (Jonah Palmer)  [Orabug: 37137136]
- uek-rpm: Set CONFIG_CRYPTO_FIPS_NAME for ol9 Pensando embedded kernels (Jonah Palmer)  [Orabug: 37137136]
- uek-rpm: Set CONFIG_CRYPTO_FIPS_NAME for ol9 T93 embedded kernels (Jonah Palmer)  [Orabug: 37137136]
- uek-rpm: Set CONFIG_CRYPTO_FIPS_NAME for ol9 MIPS64 embedded kernels (Jonah Palmer)  [Orabug: 37137136]
- uek-rpm: Set CONFIG_CRYPTO_FIPS_NAME for ol8 Bluefield 3 smartnic embedded kernels (Jonah Palmer)  [Orabug: 37137136]
- uek-rpm: Set CONFIG_CRYPTO_FIPS_NAME for ol8/ol9 standard kernels (Jonah Palmer)  [Orabug: 37137136]
- uek-rpm: Set CONFIG_CRYPTO_FIPS_NAME for ol8/ol9 container kernels (Jonah Palmer)  [Orabug: 37137136]

[5.15.0-303.168.1]
- LTS version: v5.15.168 (Vijayendra Suman)
- net: xilinx: axienet: Schedule NAPI in two steps (Sean Anderson)
- selftests: net: more strict check in net_helper (Paolo Abeni)
- net: axienet: start napi before enabling Rx/Tx (Andy Chiu)
- ext4: fix warning in ext4_dio_write_end_io() (Jan Kara)
- netfilter: ip6t_rpfilter: Fix regression with VRF interfaces (Phil Sutter)
- net: vrf: determine the dst using the original ifindex for multicast (Antoine Tenart)
- net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev (Andrea Mayer)
- xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup (David Ahern)
- net: geneve: add missing netlink policy and size for IFLA_GENEVE_INNER_PROTO_INHERIT (Eyal Birger)
- block, bfq: fix uaf for accessing waker_bfqq after splitting (Yu Kuai)
- kthread: unpark only parked kthread (Frederic Weisbecker) [Orabug: 37206395] {CVE-2024-50019}
- nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error (Yonatan Maman) [Orabug: 37252307] {CVE-2024-50096}
- mptcp: pm: do not remove closing subflows (Matthieu Baerts (NGI0))
- net: dsa: lan9303: ensure chip reset and wait for READY status (Anatolij Gustschin)
- net: Fix an unsafe loop on the list (Anastasia Kovaleva) [Orabug: 37206408] {CVE-2024-50024}
- net: explicitly clear the sk pointer, when pf-&gt;create fails (Ignat Korchagin)
- drm/v3d: Stop the active perfmon before being destroyed (Maira Canal) [Orabug: 37206424] {CVE-2024-50031}
- hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma (SurajSonawane2415)
- usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip (Icenowy Zheng)
- usb: xhci: Fix problem with xhci resume from suspend (Jose Alberto Reguero)
- usb: dwc3: core: Stop processing of pending events if controller is halted (Selvarasu Ganesan)
- Revert 'usb: yurex: Replace snprintf() with the safer scnprintf() variant' (Oliver Neukum)
- HID: plantronics: Workaround for an unexcepted opposite volume key (Wade Wang)
- resource: fix region_intersects() vs add_memory_driver_managed() (Huang Ying) [Orabug: 37200930] {CVE-2024-49878}
- HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() (Basavaraj Natikar) [Orabug: 37264222] {CVE-2024-50189}
- hwmon: (adt7470) Add missing dependency on REGMAP_I2C (Javier Carrasco)
- hwmon: (adm9240) Add missing dependency on REGMAP_I2C (Javier Carrasco)
- hwmon: (tmp513) Add missing dependency on REGMAP_I2C (Guenter Roeck)
- x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported (Mitchell Levy)
- RDMA/hns: Fix UAF for cq async event (Chengchang Tang) [Orabug: 36753395] {CVE-2024-38545}
- slip: make slhc_remember() more robust against malicious packets (Eric Dumazet) [Orabug: 37206428] {CVE-2024-50033}
- ppp: fix ppp_async_encode() illegal access (Eric Dumazet) [Orabug: 37206434] {CVE-2024-50035}
- mctp: Handle error of rtnl_register_module(). (Kuniyuki Iwashima)
- rtnetlink: Add bulk registration helpers for rtnetlink message handlers. (Kuniyuki Iwashima)
- net: rtnetlink: add msg kind names (Nikolay Aleksandrov)
- netfilter: fib: check correct rtable in vrf setups (Florian Westphal)
- netfilter: rpfilter/fib: Set -&gt;flowic_uid correctly for user namespaces. (Guillaume Nault)
- netfilter: rpfilter/fib: Populate flowic_l3mdev field (Phil Sutter)
- netfilter: xtables: avoid NFPROTO_UNSPEC where needed (Florian Westphal) [Orabug: 37206449] {CVE-2024-50038}
- sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start (Xin Long)
- net: ibm: emac: mal: fix wrong goto (Rosen Penev)
- net/sched: accept TCA_STAB only for root qdisc (Eric Dumazet) [Orabug: 37206456] {CVE-2024-50039}
- igb: Do not bring the device up after non-fatal error (Mohamed Khalfella) [Orabug: 37206463] {CVE-2024-50040}
- i40e: Fix macvlan leak by synchronizing access to mac_filter_hash (Aleksandr Loktionov) [Orabug: 37206468] {CVE-2024-50041}
- ice: Fix netif_is_ice() in Safe Mode (Marcin Szycik)
- gpio: aspeed: Use devm_clk api to manage clock source (Billy Tsai)
- gpio: aspeed: Add the flush write to ensure the write complete. (Billy Tsai)
- net: dsa: b53: fix jumbo frames on 10/100 ports (Jonas Gorski)
- net: dsa: b53: allow lower MTUs on BCM5325/5365 (Jonas Gorski)
- net: dsa: b53: fix max MTU for BCM5325/BCM5365 (Jonas Gorski)
- net: dsa: b53: fix max MTU for 1g switches (Jonas Gorski)
- net: dsa: b53: fix jumbo frame mtu check (Jonas Gorski)
- thermal: intel: int340x: processor: Fix warning during module unload (Zhang Rui) [Orabug: 37252297] {CVE-2024-50093}
- thermal: int340x: processor_thermal: Set feature mask before proc_thermal_add (Srinivas Pandruvada)
- net: phy: bcm84881: Fix some error handling paths (Christophe JAILLET)
- Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (Luiz Augusto von Dentz) [Orabug: 37206473] {CVE-2024-50044}
- netfilter: br_netfilter: fix panic with metadata_dst skb (Andy Roulin) [Orabug: 37206481] {CVE-2024-50045}
- tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe (Neal Cardwell)
- tcp: fix to allow timestamp undo if no retransmits were sent (Neal Cardwell)
- net: phy: dp83869: fix memory corruption when enabling fiber (Ingo van Lil) [Orabug: 37264220] {CVE-2024-50188}
- NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() (Yanjun Zhang) [Orabug: 37206486] {CVE-2024-50046}
- SUNRPC: Fix integer overflow in decode_rc_list() (Dan Carpenter)
- ice: fix VLAN replay after reset (Dave Ertman)
- NFSD: Mark filecache 'down' if init fails (Chuck Lever)
- RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (Bob Pearson)
- fbdev: sisfb: Fix strbuf array overflow (Andrey Shumilin) [Orabug: 37264185] {CVE-2024-50180}
- drm/amd/display: Check null pointer before dereferencing se (Alex Hung) [Orabug: 37206502] {CVE-2024-50049}
- driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute (Zijun Hu)
- tools/iio: Add memory allocation failure check for trigger_name (Zhu Jun)
- virtio_pmem: Check device status before requesting flush (Philip Chen) [Orabug: 37264203] {CVE-2024-50184}
- comedi: ni_routing: tools: Check when the file could not be opened (Ruffalo Lavoisier)
- usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario (Shawn Shao)
- usb: chipidea: udc: enable suspend interrupt after usb reset (Xu Yang)
- clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D (Peng Fan) [Orabug: 37264190] {CVE-2024-50181}
- remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table (Peng Fan)
- media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put() (Yunke Cao)
- ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition (Kaixin Wang) [Orabug: 37206539] {CVE-2024-50059}
- PCI: Mark Creative Labs EMU20k2 INTx masking as broken (Alex Williamson)
- i2c: i801: Use a different adapter-name for IDF adapters (Hans de Goede)
- PCI: Add ACS quirk for Qualcomm SA8775P (Subramanian Ananthanarayanan)
- clk: bcm: bcm53573: fix OF node leak in init (Krzysztof Kozlowski)
- RDMA/rtrs-srv: Avoid null pointer deref during path establishment (Md Haris Iqbal) [Orabug: 37206562] {CVE-2024-50062}
- PCI: Add function 0 DMA alias quirk for Glenfly Arise chip (WangYuli)
- RDMA/mad: Improve handling of timed out WRs of mad agent (Saravanan Vajravel) [Orabug: 37252300] {CVE-2024-50095}
- ktest.pl: Avoid false positives with grub2 skip regex (Daniel Jordan)
- s390/cpum_sf: Remove WARN_ON_ONCE statements (Thomas Richter)
- ext4: nested locking for xattr inode (Wojciech Gladysz)
- ext4: don't set SB_RDONLY after filesystem errors (Jan Kara) [Orabug: 37264225] {CVE-2024-50191}
- bpf, x64: Fix a jit convergence issue (Yonghong Song)
- s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Gerald Schaefer)
- s390/facility: Disable compile time optimization for decompressor code (Heiko Carstens)
- bpf: Check percpu map value size first (Tao Chen)
- Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal (Mathias Krause)
- virtio_console: fix misc probe bugs (Michael S. Tsirkin)
- fs/ntfs3: Refactor enum_rstbl to suppress static checker (Konstantin Komarov)
- selftests: net: Remove executable bits from library scripts (Benjamin Poirier)
- selftests/net: synchronize udpgro tests' tx and rx connection (Lucas Karpinski)
- selftests/net: give more time to udpgro bg processes to complete startup (Adrien Thierry)
- tracing: Have saved_cmdlines arrays all in one allocation (Steven Rostedt (Google))
- drm/crtc: fix uninitialized variable use even harder (Rob Clark)
- tracing: Remove precision vsnprintf() check from print event (Steven Rostedt (Google))
- net: ethernet: cortina: Drop TSO support (Linus Walleij)
- unicode: Don't special case ignorable code points (Gabriel Krisman Bertazi) [Orabug: 37252273] {CVE-2024-50089}
- ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate() (Jaroslav Kysela) [Orabug: 36983951] {CVE-2023-52904}
- perf report: Fix segfault when 'sym' sort key is not used (Namhyung Kim)
- 9p: add missing locking around taking dentry fid list (Dominique Martinet) [Orabug: 36774627] {CVE-2024-39463}
- ext4: fix inode tree inconsistency caused by ENOMEM (zhanchengbin)
- Revert 'arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings' (Sumit Semwal)
- ACPI: battery: Fix possible crash when unregistering a battery hook (Armin Wolf) [Orabug: 37206091] {CVE-2024-49955}
- ACPI: battery: Simplify battery hook locking (Armin Wolf)
- clk: qcom: gcc-sc8180x: Add GPLL9 support (Satya Priya Kakitapalli)
- r8169: add tally counter fields added with RTL8125 (Heiner Kallweit) [Orabug: 37206182] {CVE-2024-49973}
- r8169: Fix spelling mistake: 'tx_underun' -&gt; 'tx_underrun' (Colin Ian King)
- dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x (Satya Priya Kakitapalli)
- dt-bindings: clock: qcom: Add missing UFS QREF clocks (Manivannan Sadhasivam)
- media: imx335: Fix reset-gpio handling (Umang Jain)
- media: i2c: imx335: Enable regulator supplies (Kieran Bingham)
- drm/rockchip: vop: clear DMA stop bit on RK3066 (Val Packett)
- drm/rockchip: support gamma control on RK3399 (Hugh Cole-Baker)
- drm/rockchip: define gamma registers for RK3399 (Hugh Cole-Baker)
- lib/buildid: harden build ID parsing logic (Andrii Nakryiko)
- build-id: require program headers to be right after ELF header (Alexey Dobriyan)
- drm/amd/display: Allow backlight to go below AMDGPU_DM_DEFAULT_MIN_BACKLIGHT (Mario Limonciello)
- uprobes: fix kernel info leak via '[uprobes]' vma (Oleg Nesterov)
- arm64: cputype: Add Neoverse-N3 definitions (Mark Rutland)
- arm64: Add Cortex-715 CPU part definition (Anshuman Khandual)
- ext4: dax: fix overflowing extents beyond inode size when partially writing (Zhihao Cheng) [Orabug: 37206370] {CVE-2024-50015}
- ext4: properly sync file size update after O_SYNC direct IO (Jan Kara)
- spi: bcm63xx: Fix missing pm_runtime_disable() (Jinjie Ruan)
- i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled (Jinjie Ruan)
- i2c: xiic: Use devm_clk_get_enabled() (Andi Shyti)
- i2c: core: Lock address during client device instantiation (Heiner Kallweit)
- i2c: create debugfs entry per adapter (Wolfram Sang)
- kconfig: qconf: fix buffer overflow in debug links (Masahiro Yamada)
- drm/amd/display: Fix system hang while resume with TBT monitor (Tom Chung) [Orabug: 37206307] {CVE-2024-50003}
- drm/sched: Add locking to drm_sched_entity_modify_sched (Tvrtko Ursulin)
- close_range(): fix the logics in descriptor table trimming (Al Viro)
- tracing/timerlat: Fix a race during cpuhp processing (Wei Li) [Orabug: 37200894] {CVE-2024-49866}
- tracing/hwlat: Fix a race during cpuhp processing (Wei Li)
- gpio: davinci: fix lazy disable (Emanuele Ghidoli)
- btrfs: wait for fixup workers before stopping cleaner kthread during umount (Filipe Manana) [Orabug: 37200896] {CVE-2024-49867}
- btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (Qu Wenruo) [Orabug: 37200902] {CVE-2024-49868}
- ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[] (Hans de Goede)
- ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[] (Hans de Goede)
- Input: adp5589-keys - fix adp5589_gpio_get_value() (Nuno Sa)
- Input: adp5589-keys - fix NULL pointer dereference (Nuno Sa) [Orabug: 37200911] {CVE-2024-49871}
- rtc: at91sam9: fix OF node leak in probe() error path (Krzysztof Kozlowski)
- net: stmmac: Fix zero-division error when disabling tc cbs (KhaiWenTan) [Orabug: 37206640] {CVE-2024-49977}
- tomoyo: fallback to realpath if symlink's pathname does not exist (Tetsuo Handa)
- iio: magnetometer: ak8975: Fix reading for ak099xx sensors (Barnabas Czeman)
- clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table (Satya Priya Kakitapalli)
- clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable() (Manivannan Sadhasivam)
- media: venus: fix use after free bug in venus_remove due to race condition (Zheng Wang) [Orabug: 37206208] {CVE-2024-49981}
- clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src (Satya Priya Kakitapalli)
- clk: qcom: clk-rpmh: Fix overflow in BCM vote (Mike Tipton)
- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (Hans Verkuil)
- media: sun4i_csi: Implement link validate for sun4i_csi subdev (Laurent Pinchart)
- clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks (Dmitry Baryshkov)
- clk: rockchip: fix error for unknown clocks (Sebastian Reichel)
- aoe: fix the potential use-after-free problem in more places (Chun-Yi Lee) [Orabug: 37206641] {CVE-2024-49982}
- NFSD: Fix NFSv4's PUTPUBFH operation (Chuck Lever)
- nfsd: map the EBADMSG to nfserr_io to avoid warning (Li Lingfeng) [Orabug: 37200917] {CVE-2024-49875}
- nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (NeilBrown)
- perf hist: Update hist symbol when updating maps (Matt Fleming)
- exfat: fix memory leak in exfat_load_bitmap() (Yuezhang Mo) [Orabug: 37206359] {CVE-2024-50013}
- riscv: define ILLEGAL_POINTER_VALUE for 64bit (Jisheng Zhang)
- ext4: mark fc as ineligible using an handle in ext4_xattr_set() (Luis Henriques (SUSE))
- ext4: use handle to mark fc as ineligible in __track_dentry_update() (Luis Henriques (SUSE))
- ext4: fix fast commit inode enqueueing during a full journal commit (Luis Henriques (SUSE))
- ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list() (Luis Henriques (SUSE))
- ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() (Luis Henriques (SUSE))
- ext4: update orig_path in ext4_find_extent() (Baokun Li) [Orabug: 37200941] {CVE-2024-49881}
- ext4: fix double brelse() the buffer of the extents path (Baokun Li) [Orabug: 37200947] {CVE-2024-49882}
- ext4: aovid use-after-free in ext4_ext_insert_extent() (Baokun Li) [Orabug: 37200953] {CVE-2024-49883}
- ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (Baokun Li) [Orabug: 37206215] {CVE-2024-49983}
- ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() (Luis Henriques (SUSE))
- ext4: propagate errors from ext4_find_extent() in ext4_insert_range() (Baokun Li)
- ext4: fix slab-use-after-free in ext4_split_extent_at() (Baokun Li) [Orabug: 37200959] {CVE-2024-49884}
- ext4: correct encrypted dentry name hash when not casefolded (yao.ly)
- ext4: no need to continue when the number of entries is 1 (Edward Adam Davis) [Orabug: 37206145] {CVE-2024-49967}
- ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9 (Ai Chao)
- ALSA: line6: add hw monitor volume control to POD HD500X (Hans P. Moller)
- ALSA: usb-audio: Add native DSD support for Luxman D-08u (Jan Lalinsky)
- ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET (Lianqin Hu)
- ALSA: core: add isascii() check to card ID generator (Jaroslav Kysela)
- drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS (Thomas Zimmermann)
- parisc: Fix itlb miss handler for 64-bit programs (Helge Deller)
- perf/core: Fix small negative period being ignored (Luo Gengkun)
- power: supply: hwmon: Fix missing temp1_max_alarm attribute (Hans de Goede)
- spi: bcm63xx: Fix module autoloading (Jinjie Ruan)
- firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp() (Krzysztof Kozlowski)
- i2c: xiic: Wait for TX empty to avoid missed TX NAKs (Robert Hancock)
- i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() (Jinjie Ruan)
- i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume (Marek Vasut) [Orabug: 37206219] {CVE-2024-49985}
- platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug (Zach Wade) [Orabug: 37200965] {CVE-2024-49886}
- selftests: vDSO: fix vdso_config for s390 (Heiko Carstens)
- selftests: vDSO: fix ELF hash table entry size for s390x (Jens Remus)
- selftests/mm: fix charge_reserved_hugetlb.sh test (David Hildenbrand)
- selftests: vDSO: fix vDSO symbols lookup for powerpc64 (Christophe Leroy)
- selftests: vDSO: fix vdso_config for powerpc (Christophe Leroy)
- selftests: vDSO: fix vDSO name for powerpc (Christophe Leroy)
- selftests: breakpoints: use remaining time to check if suspend succeed (Yifei Liu)
- spi: s3c64xx: fix timeout counters in flush_fifo (Ben Dooks)
- spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled (Jinjie Ruan)
- usb: typec: tcpm: Check for port partner validity before consuming it (Badhri Jagan Sridharan) [Orabug: 36683242] {CVE-2024-36893}
- blk-integrity: register sysfs attributes on struct device (Thomas Weissschuh)
- blk-integrity: convert to struct device_attribute (Thomas Weissschuh)
- blk-integrity: use sysfs_emit (Thomas Weissschuh)
- ext4: fix i_data_sem unlock order in ext4_ind_migrate() (Artem Sadovnikov) [Orabug: 37206322] {CVE-2024-50006}
- ext4: avoid use-after-free in ext4_ext_show_leaf() (Baokun Li) [Orabug: 37205705] {CVE-2024-49889}
- ext4: ext4_search_dir should return a proper error (Thadeu Lima de Souza Cascardo)
- of/irq: Refer to actual buffer size in of_irq_parse_one() (Geert Uytterhoeven)
- drm/amd/pm: ensure the fw_info is not null before using it (Tim Huang) [Orabug: 37205712] {CVE-2024-49890}
- drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() (Geert Uytterhoeven)
- scsi: aacraid: Rearrange order of struct aac_srb_unit (Kees Cook)
- drm/printer: Allow NULL data in devcoredump printer (Matthew Brost)
- drm/amd/display: Initialize get_bytes_per_element's default to 1 (Alex Hung) [Orabug: 37205726] {CVE-2024-49892}
- drm/amd/display: Fix index out of bounds in DCN30 color transformation (Srinivasan Shanmugam) [Orabug: 37206158] {CVE-2024-49969} {CVE-2024-49895}
- drm/amd/display: Fix index out of bounds in degamma hardware format translation (Srinivasan Shanmugam) [Orabug: 37205739] {CVE-2024-49894}
- drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation (Srinivasan Shanmugam) [Orabug: 37205745] {CVE-2024-49895} {CVE-2024-49969}
- drm/amd/display: Check stream before comparing them (Alex Hung) [Orabug: 37205751] {CVE-2024-49896}
- platform/x86: touchscreen_dmi: add nanote-next quirk (Ckath)
- HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio (Vishnu Sankar)
- drm/amdgpu: enable gfxoff quirk on HP 705G4 (Peng Liu)
- drm/amdgpu: add raven1 gfxoff quirk (Peng Liu)
- jfs: Fix uninit-value access of new_ea in ea_buffer (Zhao Mengmeng) [Orabug: 37205777] {CVE-2024-49900}
- scsi: smartpqi: correct stream detection (Mahesh Rajashekhara)
- jfs: check if leafidx greater than num leaves per dmap tree (Edward Adam Davis) [Orabug: 37205789] {CVE-2024-49902}
- jfs: Fix uaf in dbFreeBits (Edward Adam Davis) [Orabug: 37205794] {CVE-2024-49903}
- jfs: UBSAN: shift-out-of-bounds in dbFindBits (Remington Brasga)
- drm/amd/display: Check null pointers before using dc-&gt;clk_mgr (Alex Hung) [Orabug: 37205820] {CVE-2024-49907}
- ata: sata_sil: Rename sil_blacklist to sil_quirks (Damien Le Moal)
- drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream (Srinivasan Shanmugam) [Orabug: 37205857] {CVE-2024-49913}
- iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count (Sanjay K Kumar) [Orabug: 37206262] {CVE-2024-49993}
- iommu/vt-d: Always reserve a domain ID for identity setup (Lu Baolu)
- power: reset: brcmstb: Do not go into infinite loop if reset fails (Andrew Davis)
- iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux (Marc Gonzalez)
- rcuscale: Provide clear error when async specified without primitives (Paul E. McKenney)
- fbdev: pxafb: Fix possible use after free in pxafb_task() (Kaixin Wang) [Orabug: 37205935] {CVE-2024-49924}
- x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments() (Kees Cook)
- ALSA: hdsp: Break infinite MIDI input flush loop (Takashi Iwai)
- ALSA: asihpi: Fix potential OOB array access (Takashi Iwai) [Orabug: 37206327] {CVE-2024-50007}
- tools/x86/kcpuid: Protect against faulty 'max subleaf' values (Ahmed S. Darwish)
- ALSA: usb-audio: Add logitech Audio profile quirk (Joshua Pius)
- ALSA: usb-audio: Define macros for quirk table entries (Takashi Iwai)
- x86/ioapic: Handle allocation failures gracefully (Thomas Gleixner) [Orabug: 37205954] {CVE-2024-49927}
- ALSA: usb-audio: Add input value sanity checks for standard types (Takashi Iwai)
- signal: Replace BUG_ON()s (Thomas Gleixner)
- nfp: Use IRQF_NO_AUTOEN flag in request_irq() (Jinjie Ruan)
- wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() (Gustavo A. R. Silva) [Orabug: 37206332] {CVE-2024-50008}
- wifi: mt76: mt7915: hold dev-&gt;mt76.mutex while disabling tx worker (Felix Fietkau)
- proc: add config &amp; param to block forcing mem writes (Adrian Ratiu)
- ACPICA: iasl: handle empty connection_node (Aleksandrs Vinarskis)
- tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process (Jason Xing)
- net: atlantic: Avoid warning about potential string truncation (Simon Horman)
- ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family (Ido Schimmel)
- ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR). (Kuniyuki Iwashima)
- net: mvpp2: Increase size of queue_name buffer (Simon Horman)
- tipc: guard against string buffer overrun (Simon Horman) [Orabug: 37206276] {CVE-2024-49995}
- ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() (Pei Xiao) [Orabug: 37206122] {CVE-2024-49962}
- ACPI: EC: Do not release locks during operation region accesses (Rafael J. Wysocki)
- wifi: rtw88: select WANT_DEV_COREDUMP (Zong-Zhe Yang)
- wifi: ath11k: fix array out-of-bound access in SoC stats (Karthikeyan Periyasamy) [Orabug: 37205975] {CVE-2024-49930}
- nvme-pci: qdepth 1 quirk (Keith Busch)
- blk_iocost: fix more out of bound shifts (Konstantin Ovsepian) [Orabug: 37205994] {CVE-2024-49933}
- net: sched: consistently use rcu_replace_pointer() in taprio_change() (Dmitry Antipov)
- ACPICA: Fix memory leak if acpi_ps_get_next_field() fails (Armin Wolf)
- ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails (Armin Wolf)
- ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206005] {CVE-2024-49935}
- net: hisilicon: hns_mdio: fix OF node leak in probe() (Krzysztof Kozlowski)
- net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info() (Krzysztof Kozlowski)
- net: hisilicon: hip04: fix OF node leak in probe() (Krzysztof Kozlowski)
- net/xen-netback: prevent UAF in xenvif_flush_hash() (Jeongjun Park) [Orabug: 37206011] {CVE-2024-49936}
- ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node() (Aleksandr Mishin)
- wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (Toke Hoiland-Jorgensen) [Orabug: 37206028] {CVE-2024-49938}
- wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats() (Dmitry Kandybka)
- f2fs: Require FMODE_WRITE for atomic write ioctls (Jann Horn) [Orabug: 37200793] {CVE-2024-47740}
- ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin (Takashi Iwai)
- ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m (Hui Wang)
- ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs (Takashi Iwai)
- ALSA: hda/realtek: Fix the push button function for the ALC257 (Oder Chiou)
- ALSA: mixer_oss: Remove some incorrect kfree_const() usages (Christophe JAILLET)
- media: usbtv: Remove useless locks in usbtv_video_free() (Benjamin Gaignard) [Orabug: 36598250] {CVE-2024-27072}
- i2c: xiic: Try re-initialization on bus busy timeout (Robert Hancock)
- i2c: xiic: improve error message when transfer fails to start (Marc Ferland)
- i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path (Lars-Peter Clausen)
- i2c: xiic: Fix RX IRQ busy check (Marek Vasut)
- i2c: xiic: Switch from waitqueue to completion (Marek Vasut)
- i2c: xiic: Fix broken locking on tx_msg (Marek Vasut)
- sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (Xin Long) [Orabug: 37206050] {CVE-2024-49944}
- ppp: do not assume bh is held in ppp_channel_bridge_input() (Eric Dumazet) [Orabug: 37206060] {CVE-2024-49946}
- ipv4: ip_gre: Fix drops of small packets in ipgre_xmit (Anton Danilov)
- net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check (Shenwei Wang)
- net: stmmac: Disable automatic FCS/Pad stripping (Kurt Kanzenbach)
- stmmac_pci: Fix underflow size in stmmac_rx (Zekun Shen)
- net: add more sanity checks to qdisc_pkt_len_init() (Eric Dumazet) [Orabug: 37206063] {CVE-2024-49948}
- net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Eric Dumazet) [Orabug: 37206069] {CVE-2024-49949}
- net: ethernet: lantiq_etop: fix memory disclosure (Aleksander Jan Bajkowski) [Orabug: 37206288] {CVE-2024-49997}
- Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq() (Jinjie Ruan)
- netfilter: nf_tables: prevent nf_skb_duplicated corruption (Eric Dumazet) [Orabug: 37206080] {CVE-2024-49952}
- net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq() (Jinjie Ruan)
- netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED (Phil Sutter)
- net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() (Elena Salomatkina) [Orabug: 37206298] {CVE-2024-50000}
- net/mlx5: Added cond_resched() to crdump collection (Mohamed Khalfella)
- net/mlx5: Fix error path in multi-packet WQE transmit (Gerd Bayer) [Orabug: 37206301] {CVE-2024-50001}
- ieee802154: Fix build error (Jinjie Ruan)
- ceph: remove the incorrect Fw reference check when dirtying pages (Xiubo Li) [Orabug: 37264180] {CVE-2024-50179}
- mailbox: bcm2835: Fix timeout during suspend mode (Stefan Wahren) [Orabug: 37206129] {CVE-2024-49963}
- mailbox: rockchip: fix a typo in module autoloading (Liao Chen)
- static_call: Replace pointless WARN_ON() in static_call_module_notify() (Thomas Gleixner) [Orabug: 37206089] {CVE-2024-49954}
- static_call: Handle module init failure correctly in static_call_del_module() (Thomas Gleixner) [Orabug: 37206305] {CVE-2024-50002}
- spi: lpspi: Simplify some error message (Christophe JAILLET)
- usb: yurex: Fix inconsistent locking bug in yurex_read() (Harshit Mogalapalli)
- i2c: isch: Add missed 'else' (Andy Shevchenko)
- i2c: aspeed: Update the stop sw state when the bus recovery occurs (Tommy Huang)
- mm: only enforce minimum stack gap size if it's sensible (David Gow)
- lockdep: fix deadlock issue between lockdep and rcu (Zhiguo Niu)
- bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0 (Song Liu)
- x86/entry: Remove unwanted instrumentation in common_interrupt() (Dmitry Vyukov)
- x86/idtentry: Incorporate definitions/declarations of the FRED entries (Xin Li)
- pps: add an error check in parport_attach (Ma Ke)
- pps: remove usage of the deprecated ida_simple_xx() API (Christophe JAILLET)
- usb: xhci: fix loss of data on Cadence xHC (Pawel Laszczak)
- xhci: Add a quirk for writing ERST in high-low order (Daehwan Jung)
- xhci: Preserve RsvdP bits in ERSTBA register correctly (Lukas Wunner)
- xhci: Refactor interrupter code for initial multi interrupter support. (Mathias Nyman)
- xhci: remove xhci_test_trb_in_td_math early development check (Mathias Nyman)
- xhci: fix event ring segment table related masks and variables in header (Mathias Nyman)
- USB: misc: yurex: fix race between read and write (Oliver Neukum)
- usb: yurex: Replace snprintf() with the safer scnprintf() variant (Lee Jones)
- soc: versatile: realview: fix soc_dev leak during device remove (Krzysztof Kozlowski)
- soc: versatile: realview: fix memory leak during device remove (Krzysztof Kozlowski)
- padata: use integer wrap around to prevent deadlock on seq_nr overflow (VanGiang Nguyen) [Orabug: 37200789] {CVE-2024-47739}
- EDAC/igen6: Fix conversion of system address to physical memory address (Qiuxu Zhuo)
- nfs: fix memory leak in error path of nfs4_do_reclaim (Li Lingfeng)
- fs: Fix file_set_fowner LSM hook inconsistencies (Mickael Salaun)
- vfs: fix race between evice_inodes() and find_inode()&amp;iput() (Julian Sun) [Orabug: 37200603] {CVE-2024-47679}
- arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity (Dragan Simic)
- arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency (Dragan Simic)
- hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume (Gaosheng Cui)
- hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init (Gaosheng Cui)
- hwrng: mtk - Use devm_pm_runtime_enable (Guoqing Jiang)
- f2fs: avoid potential int overflow in sanity_check_area_boundary() (Nikita Zhandarovich)
- f2fs: prevent possible int overflow in dir_block_index() (Nikita Zhandarovich)
- debugobjects: Fix conditions in fill_pool() (Zhen Lei)
- wifi: mt76: mt7615: check devm_kasprintf() returned value (Ma Ke)
- wifi: rtw88: 8822c: Fix reported RX band width (Bitterblue Smith)
- perf/x86/intel/pt: Fix sampling synchronization (Adrian Hunter)
- efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (Ard Biesheuvel) [Orabug: 37200864] {CVE-2024-49858}
- ACPI: resource: Add another DMI match for the TongFang GMxXGxx (Werner Sembach)
- ACPI: sysfs: validate return type of _STR method (Thomas Weissschuh) [Orabug: 37200877] {CVE-2024-49860}
- drbd: Add NULL check for net_conf to prevent dereference in state validation (Mikhail Lobanov)
- drbd: Fix atomicity violation in drbd_uuid_set_bm() (Qiu-ji Chen)
- crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure (Pavan Kumar Paluri)
- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them. (Mathias Nyman)
- tty: rp2: Fix reset with non forgiving PCIe host bridges (Florian Fainelli)
- firmware_loader: Block path traversal (Jann Horn) [Orabug: 37200801] {CVE-2024-47742}
- bus: integrator-lm: fix OF node leak in probe() (Krzysztof Kozlowski)
- usb: dwc2: drd: fix clock gating on USB role switch (Tomas Marek)
- usb: cdnsp: Fix incorrect usb_request status (Pawel Laszczak)
- USB: class: CDC-ACM: fix race between get_serial and set_serial (Oliver Neukum)
- USB: misc: cypress_cy7c63: check for short transfer (Oliver Neukum)
- USB: appledisplay: close race between probe and completion handler (Oliver Neukum)
- usbnet: fix cyclical race on disconnect with work queue (Oliver Neukum)
- scsi: mac_scsi: Disallow bus errors during PDMA send (Finn Thain)
- scsi: mac_scsi: Refactor polling loop (Finn Thain)
- scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages (Finn Thain)
- drm/amd/display: Validate backlight caps are sane (Mario Limonciello)
- drm/amd/display: Round calculated vtotal (Robin Chen)
- Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line (Werner Sembach)
- Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table (Werner Sembach)
- Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table (Werner Sembach)
- Revert 'media: tuners: fix error return code of hybrid_tuner_request_state()' (Roman Smirnov)
- soc: versatile: integrator: fix OF node leak in probe() error path (Krzysztof Kozlowski)
- ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error (Ma Ke)
- PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (Sean Anderson)
- Remove *.orig pattern from .gitignore (Laurent Pinchart)
- selinux,smack: don't bypass permissions check in inode_setsecctx hook (Scott Mayhew) [Orabug: 37070761] {CVE-2024-46695}
- vfio/pci: fix potential memory leak in vfio_intx_enable() (Ye Bin) [Orabug: 36765615] {CVE-2024-38632}
- x86/mm: Switch to new Intel CPU model defines (Tony Luck)
- Input: goodix - use the new soc_intel_is_byt() helper (Hans de Goede)
- drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination (Fangzhi Zuo)
- netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS (Simon Horman)
- netfilter: nf_tables: Keep deleted flowtable hooks until after RCU (Phil Sutter)
- bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave() (Jiwon Kim) [Orabug: 37200774] {CVE-2024-47734}
- net: qrtr: Update packets cloning when broadcasting (Youssef Samir)
- tcp: check skb is non-NULL in tcp_rto_delta_us() (Josh Hunt) [Orabug: 37200622] {CVE-2024-47684}
- net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL (Thomas Weissschuh)
- net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (Kaixin Wang) [Orabug: 37200817] {CVE-2024-47747}
- netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Eric Dumazet) [Orabug: 37200629] {CVE-2024-47685}
- net: xilinx: axienet: Fix packet counting (Sean Anderson)
- net: axienet: Switch to 64-bit RX/TX statistics (Robert Hancock)
- net: axienet: Use NAPI for TX completion path (Robert Hancock)
- net: axienet: Be more careful about updating tx_bd_tail (Robert Hancock)
- net: axienet: add coalesce timer ethtool configuration (Robert Hancock)
- net: axienet: reduce default RX interrupt threshold to 1 (Robert Hancock)
- net: axienet: implement NAPI and GRO receive (Robert Hancock)
- net: axienet: don't set IRQ timer when IRQ delay not used (Robert Hancock)
- net: axienet: Clean up DMA start/stop and error handling (Robert Hancock)
- net: axienet: Clean up device used for DMA calls (Robert Hancock)
- Revert 'dm: requeue IO if mapping table not yet available' (Mikulas Patocka)
- vhost_vdpa: assign irq bypass producer token correctly (Jason Wang) [Orabug: 37200820] {CVE-2024-47748}
- vdpa: Add eventfd for the vdpa callback (Xie Yongji)
- interconnect: qcom: sm8250: Enable sync_state (Konrad Dybcio)
- coresight: tmc: sg: Do not leak sg_table (Suzuki K Poulose)
- iio: adc: ad7606: fix standby gpio state to match the documentation (Guillaume Stols)
- iio: adc: ad7606: fix oversampling gpio array (Guillaume Stols)
- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time (Jinjie Ruan)
- spi: lpspi: release requested DMA channels (Alexander Stein)
- spi: lpspi: Silence error message upon deferred probe (Alexander Stein)
- f2fs: get rid of online repaire on corrupted directory (Chao Yu) [Orabug: 37200641] {CVE-2024-47690}
- f2fs: clean up w/ dotdot_name (Chao Yu)
- f2fs: introduce F2FS_IPU_HONOR_OPU_WRITE ipu policy (Chao Yu)
- f2fs: fix to wait page writeback before setting gcing flag (Chao Yu)
- f2fs: optimize error handling in redirty_blocks (Jack Qiu)
- f2fs: reduce expensive checkpoint trigger frequency (Chao Yu)
- f2fs: remove unneeded check condition in __f2fs_setxattr() (Chao Yu)
- f2fs: fix to update i_ctime in __f2fs_setxattr() (Chao Yu)
- f2fs: fix typo (Yonggil Song)
- nfsd: return -EINVAL when namelen is 0 (Li Lingfeng) [Orabug: 37200649] {CVE-2024-47692}
- nfsd: call cache_put if xdr_reserve_space returns NULL (Guoqing Jiang) [Orabug: 37200782] {CVE-2024-47737}
- ntb_perf: Fix printk format (Max Hawking)
- ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() (Jinjie Ruan)
- RDMA/irdma: fix error message in irdma_modify_qp_roce() (Vitaliy Shevtsov)
- RDMA/cxgb4: Added NULL check for lookup_atid (Mikhail Lobanov) [Orabug: 37200823] {CVE-2024-47749}
- riscv: Fix fp alignment bug in perf_callchain_user() (Jinjie Ruan)
- RDMA/hns: Optimize hem allocation performance (Junxian Huang)
- RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler (Junxian Huang)
- RDMA/hns: Refactor the abnormal interrupt handler function (Haoyue Xu)
- RDMA/hns: Fix the wrong type of return value of the interrupt handler (Haoyue Xu)
- RDMA/hns: Remove unused abnormal interrupt of type RAS (Haoyue Xu)
- RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled (Chengchang Tang) [Orabug: 37200776] {CVE-2024-47735}
- RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() (wenglianfa)
- RDMA/hns: Don't modify rq next block addr in HIP09 QPC (Junxian Huang)
- watchdog: imx_sc_wdt: Don't disable WDT in suspend (Jonas Blixt)
- IB/core: Fix ib_cache_setup_one error flow cleanup (Patrisious Haddad) [Orabug: 37200653] {CVE-2024-47693}
- pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function (Wang Jianzheng)
- pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource() (Yangtao Li)
- nfsd: fix refcount leak when file is unhashed after being found (Jeff Layton)
- nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire (Jeff Layton)
- clk: ti: dra7-atl: Fix leak of of_nodes (David Lechner)
- RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds (Md Haris Iqbal) [Orabug: 37200658] {CVE-2024-47695}
- RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer (Jack Wang)
- pinctrl: single: fix missing error code in pcs_probe() (Yang Yingliang)
- RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Zhu Yanjun) [Orabug: 37205520] {CVE-2024-47696}
- PCI: xilinx-nwl: Clean up clock on probe failure/removal (Sean Anderson)
- PCI: xilinx-nwl: Fix register misspelling (Sean Anderson)
- PCI: keystone: Fix if-statement expression in ks_pcie_quirk() (Dan Carpenter) [Orabug: 37205559] {CVE-2024-47756}
- drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (Junlin Li) [Orabug: 37200661] {CVE-2024-47697}
- drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (Junlin Li) [Orabug: 37200668] {CVE-2024-47698}
- Input: ilitek_ts_i2c - add report id message validation (Emanuele Ghidoli)
- Input: ilitek_ts_i2c - avoid wrong input subsystem sync (Emanuele Ghidoli)
- clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228 (Jonas Karlman)
- remoteproc: imx_rproc: Initialize workqueue earlier (Peng Fan)
- remoteproc: imx_rproc: Correct ddr alias for i.MX8M (Peng Fan)
- clk: imx: imx8qxp: Parent should be initialized earlier than the clock (Peng Fan)
- clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk (Peng Fan)
- clk: imx: imx8mp: fix clock tree update of TF-A managed clocks (Zhipeng Wang)
- perf time-utils: Fix 32-bit nsec parsing (Ian Rogers)
- perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time (Yang Jihong)
- perf sched timehist: Fix missing free of session in perf_sched__timehist() (Yang Jihong)
- perf mem: Free the allocated sort string, fixing a leak (Namhyung Kim)
- bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit (Daniel Borkmann)
- nilfs2: fix potential oob read in nilfs_btree_check_delete() (Ryusuke Konishi) [Orabug: 37200842] {CVE-2024-47757}
- nilfs2: determine empty node blocks as corrupted (Ryusuke Konishi)
- nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() (Ryusuke Konishi) [Orabug: 37200675] {CVE-2024-47699}
- ext4: avoid OOB when system.data xattr changes underneath the filesystem (Thadeu Lima de Souza Cascardo) [Orabug: 37200681] {CVE-2024-47701}
- ext4: return error on ext4_find_inline_entry (Thadeu Lima de Souza Cascardo)
- ext4: avoid negative min_clusters in find_group_orlov() (Kemeng Shi)
- ext4: avoid potential buffer_head leak in __ext4_new_inode() (Kemeng Shi)
- ext4: avoid buffer_head leak in ext4_mark_inode_used() (Kemeng Shi)
- smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso (Jiawei Ye)
- ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard (yangerkun)
- kthread: fix task state in kthread worker if being frozen (Chen Yu)
- xz: cleanup CRC32 edits from 2018 (Lasse Collin)
- selftests/bpf: Fix C++ compile error from missing _Bool type (Tony Ambardar)
- selftests/bpf: Fix error compiling test_lru_map.c (Tony Ambardar)
- selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc (Tony Ambardar)
- selftests/bpf: Fix compiling core_reloc.c with musl-libc (Tony Ambardar)
- selftests/bpf: Fix compiling tcp_rtt.c with musl-libc (Tony Ambardar)
- selftests/bpf: Fix compiling flow_dissector.c with musl-libc (Tony Ambardar)
- selftests/bpf: Fix compiling kfree_skb.c with musl-libc (Tony Ambardar)
- selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (Tony Ambardar)
- selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc (Tony Ambardar)
- selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c (Tony Ambardar)
- tpm: Clean up TPM space after command failure (Jonathan McDowell) [Orabug: 37200850] {CVE-2024-49851}
- xen/swiotlb: add alignment check for dma buffers (Juergen Gross)
- xen: use correct end address of kernel for conflict checking (Juergen Gross)
- drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind() (Yuesong Li)
- drm/msm: fix %s null argument error (Sherry Yang)
- ipmi: docs: don't advertise deprecated sysfs entries (Wolfram Sang)
- drm/msm/a5xx: workaround early ring-buffer emptiness check (Vladimir Lypak)
- drm/msm: Drop priv-&gt;lastctx (Rob Clark)
- drm/msm/a5xx: fix races in preemption evaluation stage (Vladimir Lypak)
- drm/msm/a5xx: properly clear preemption records on resume (Vladimir Lypak)
- drm/msm/a5xx: disable preemption in submits by default (Vladimir Lypak)
- drm/msm: Fix incorrect file name output in adreno_request_fw() (Aleksandr Mishin)
- powerpc/8xx: Fix kernel vs user address comparison (Christophe Leroy)
- powerpc/8xx: Fix initial memory mapping (Christophe Leroy)
- powerpc/32: Remove 'noltlbs' kernel parameter (Christophe Leroy)
- powerpc/32: Remove the 'nobats' kernel parameter (Christophe Leroy)
- drm/mediatek: Use spin_lock_irqsave() for CRTC event lock (Fei Shao)
- jfs: fix out-of-bounds in dbNextAG() and diAlloc() (Jeongjun Park) [Orabug: 37200739] {CVE-2024-47723}
- scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() (Dan Carpenter) [Orabug: 37200855] {CVE-2024-49852}
- drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid() (Liu Ying)
- drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets (Nikita Zhandarovich)
- drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode (Jonas Karlman)
- drm/rockchip: vop: Allow 4096px width scaling (Alex Bee)
- scsi: NCR5380: Check for phase match during PDMA fixup (Finn Thain)
- scsi: NCR5380: Add SCp members to struct NCR5380_cmd (Finn Thain)
- drm/radeon: properly handle vbios fake edid sizing (Alex Deucher)
- drm/radeon: Replace one-element array with flexible-array member (Paulo Miguel Almeida)
- drm/amdgpu: properly handle vbios fake edid sizing (Alex Deucher)
- drm/amdgpu: Replace one-element array with flexible-array member (Paulo Miguel Almeida)
- drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func (Srinivasan Shanmugam) [Orabug: 37200736] {CVE-2024-47720}
- drm/stm: Fix an error handling path in stm_drm_platform_probe() (Christophe JAILLET)
- pmdomain: core: Harden inter-column space in debug summary (Geert Uytterhoeven)
- mtd: powernv: Add check devm_kasprintf() returned value (Charles Han)
- fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() (Christophe JAILLET)
- power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense (Artur Weber)
- power: supply: axp20x_battery: Remove design from min and max voltage (Chris Morgan)
- hwmon: (ntc_thermistor) fix module autoloading (Yuntao Liu)
- mtd: slram: insert break after errors in parsing the map (Mirsad Todorovac)
- hwmon: (max16065) Fix alarm attributes (Guenter Roeck)
- hwmon: (max16065) Remove use of i2c_match_id() (Andrew Davis)
- i2c: Add i2c_get_match_data() (Biju Das)
- hwmon: (max16065) Fix overflows seen when writing limits (Guenter Roeck)
- m68k: Fix kernel_clone_args.flags in m68k_clone() (Finn Thain)
- clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() (Ankit Agrawal)
- reset: k210: fix OF node leak in probe() error path (Krzysztof Kozlowski)
- reset: berlin: fix OF node leak in probe() error path (Krzysztof Kozlowski)
- ARM: versatile: fix OF node leak in CPUs prepare (Krzysztof Kozlowski)
- ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property (Krzysztof Kozlowski)
- ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks (Alexander Dahl)
- arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes (Lad Prabhakar)
- spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ (Andy Shevchenko)
- spi: ppc4xx: handle irq_of_parse_and_map() errors (Ma Ke)
- block: fix potential invalid pointer dereference in blk_add_partition (Riyan Dhiman) [Orabug: 37200698] {CVE-2024-47705}
- block: print symbolic error name instead of error code (Christian Heusel)
- block, bfq: don't break merge chain in bfq_split_bfqq() (Yu Kuai)
- block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (Yu Kuai)
- block, bfq: fix possible UAF for bfqq-&gt;bic with merge chain (Yu Kuai)
- net: tipc: avoid possible garbage value (Su Hui)
- net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input (Justin Iurman)
- r8169: disable ALDPS per default for RTL8125 (Heiner Kallweit)
- net: enetc: Use IRQF_NO_AUTOEN flag in request_irq() (Jinjie Ruan)
- bareudp: Pull inner IP header on xmit. (Guillaume Nault)
- geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Gal Pressman)
- net: geneve: support IPv4/IPv6 as inner protocol (Eyal Birger)
- bareudp: Pull inner IP header in bareudp_udp_encap_recv(). (Guillaume Nault)
- Bluetooth: btusb: Fix not handling ZPL/short-transfer (Luiz Augusto von Dentz)
- can: m_can: m_can_close(): stop clocks after device has been shut down (Marc Kleine-Budde)
- can: bcm: Clear bo-&gt;bcm_proc_read after remove_proc_entry(). (Kuniyuki Iwashima) [Orabug: 37205475] {CVE-2024-47709}
- sock_map: Add a cond_resched() in sock_hash_free() (Eric Dumazet) [Orabug: 37200714] {CVE-2024-47710}
- wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param (Jiawei Ye) [Orabug: 37205501] {CVE-2024-47712}
- wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() (Dmitry Antipov) [Orabug: 37200719] {CVE-2024-47713}
- wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors (Dmitry Antipov)
- wifi: mt76: mt7915: fix rx filter setting for bfee functionality (Howard Hsu)
- wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() (Dmitry Antipov)
- x86/sgx: Fix deadlock in SGX NUMA node search (Aaron Lu) [Orabug: 37200860] {CVE-2024-49856}
- cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately (Nishanth Menon)
- netfilter: nf_tables: remove annotation to access set timeout while holding lock (Pablo Neira Ayuso)
- netfilter: nf_tables: reject expiration higher than timeout (Pablo Neira Ayuso)
- netfilter: nf_tables: reject element expiration with no timeout (Pablo Neira Ayuso)
- netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire (Pablo Neira Ayuso)
- ACPI: CPPC: Fix MASK_VAL() usage (Clement Leger)
- ACPI: bus: Avoid using CPPC if not supported by firmware (Rafael J. Wysocki)
- can: j1939: use correct function name in comment (Zhang Changzhong)
- padata: Honor the caller's alignment in case of chunk_size 0 (Kamlesh Gurudasani)
- wifi: iwlwifi: mvm: increase the time between ranging measurements (Avraham Stern)
- mount: handle OOM on mnt_warn_timestamp_expiry (Olaf Hering)
- fs/namespace: fnic: Switch to use %ptTd (Andy Shevchenko)
- mount: warn only once about timestamp range expiration (Anthony Iliopoulos)
- fs: explicitly unregister per-superblock BDIs (Christoph Hellwig)
- wifi: rtw88: remove CPT execution branch never used (Dmitry Kandybka)
- net: stmmac: dwmac-loongson: Init ref and PTP clocks rate (Yanteng Si)
- wifi: ath9k: Remove error checks when creating debugfs entries (Toke Hoiland-Jorgensen)
- wifi: ath9k: fix parameter check in ath9k_init_debug() (Minjie Du)
- ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() (Aleksandr Mishin)
- crypto: xor - fix template benchmarking (Helge Deller)
- wifi: rtw88: always wait for both firmware loading attempts (Dmitry Antipov) [Orabug: 37200733] {CVE-2024-47718}
- EDAC/synopsys: Fix error injection on Zynq UltraScale+ (Shubhrajyoti Datta)
- EDAC/synopsys: Fix ECC status and IRQ control race condition (Serge Semin)
- EDAC/synopsys: Re-enable the error interrupts on v3 hw (Sherry Sun)
- EDAC/synopsys: Use the correct register to disable the error interrupt on v3 hw (Sherry Sun)
- EDAC/synopsys: Add support for version 3 of the Synopsys EDAC DDR (Dinh Nguyen)
- USB: usbtmc: prevent kernel-usb-infoleak (Edward Adam Davis) [Orabug: 37159777] {CVE-2024-47671}
- USB: serial: pl2303: add device id for Macrosilicon MS3020 (Junhao Xie)
- gpiolib: cdev: Ignore reconfiguration without direction (Kent Gibson)
- inet: inet_defrag: prevent sk release while still in use (Florian Westphal) [Orabug: 36545059] {CVE-2024-26921}
- gpio: prevent potential speculation leaks in gpio_device_get_desc() (Hagar Hemdan) [Orabug: 36993133] {CVE-2024-44931}
- Revert 'wifi: cfg80211: check wiphy mutex is held for wdev mutex' (Ping-Ke Shih)
- netfilter: nf_tables: missing iterator type in lookup walk (Pablo Neira Ayuso)
- netfilter: nft_set_pipapo: walk over current view on netlink dump (Pablo Neira Ayuso) [Orabug: 36598033] {CVE-2024-27017}
- ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (Ferry Meng) [Orabug: 36891660] {CVE-2024-41016}
- ocfs2: add bounds checking to ocfs2_xattr_find_entry() (Ferry Meng) [Orabug: 37159772] {CVE-2024-47670}
- spi: spidev: Add missing spi_device_id for jg10309-01 (Geert Uytterhoeven)
- x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency (Michael Kelley)
- spi: bcm63xx: Enable module autoloading (Liao Chen)
- drm: komeda: Fix an issue related to normalized zpos (hongchi.peng)
- spi: spidev: Add an entry for elgin,jg10309-01 (Fabio Estevam)
- ASoC: tda7419: fix module autoloading (Liao Chen)
- ASoC: intel: fix module autoloading (Liao Chen)
- wifi: iwlwifi: clear trans-&gt;state earlier upon error (Emmanuel Grumbach)
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead (Emmanuel Grumbach) [Orabug: 37159780] {CVE-2024-47672}
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped (Emmanuel Grumbach) [Orabug: 37159785] {CVE-2024-47673}
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation (Daniel Gabay)
- wifi: iwlwifi: lower message level for FW buffer destination (Benjamin Berg)
- net: ftgmac100: Ensure tx descriptor updates are visible (Jacky Chou)
- microblaze: don't treat zero reserved memory regions as error (Mike Rapoport)
- pinctrl: at91: make it work with current gpiolib (Thomas Blocher)
- scsi: lpfc: Fix overflow build issue (Sherry Yang)
- ALSA: hda/realtek - FIxed ALC285 headphone no sound (Kailang Yang)
- ALSA: hda/realtek - Fixed ALC256 headphone no sound (Kailang Yang)
- ASoC: allow module autoloading for table db1200_pids (Hongbo Li)
- ASoC: meson: axg-card: fix 'use-after-free' (Arseniy Krasnov) [Orabug: 37116539] {CVE-2024-46849}
- dma-buf: heaps: Fix off-by-one in CMA heap fault handler (T.J. Mercier) [Orabug: 37116545] {CVE-2024-46852}
- soundwire: stream: Revert 'soundwire: stream: fix programming slave ports for non-continous port maps' (Krzysztof Kozlowski)
- spi: nxp-fspi: fix the KASAN report out-of-bounds bug (Han Xu) [Orabug: 37116547] {CVE-2024-46853}
- net: dpaa: Pad packets to ETH_ZLEN (Sean Anderson) [Orabug: 37116550] {CVE-2024-46854}
- netfilter: nft_socket: fix sk refcount leaks (Florian Westphal) [Orabug: 37116554] {CVE-2024-46855}
- net: ftgmac100: Enable TX interrupt to avoid TX timeout (Jacky Chou)
- fou: fix initialization of grc (Muhammad Usama Anjum) [Orabug: 37195062] {CVE-2024-46865}
- net/mlx5: Add missing masks and QoS bit masks for scheduling elements (Carolina Jubran)
- net/mlx5: Explicitly set scheduling element and TSAR type (Carolina Jubran)
- net/mlx5e: Add missing link modes to ptys2ethtool_map (Shahar Shitrit)
- igb: Always call igb_xdp_ring_update_tail() under Tx lock (Sriram Yagnaraman)
- ice: fix accounting for filters shared by multiple VSIs (Jacob Keller)
- hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev &gt;= 1.2 (Patryk Biel)
- hwmon: (pmbus) Introduce and use write_byte_data callback (Marten Lindahl)
- selftests/bpf: Support SOCK_STREAM in unix_inet_redir_to_connected() (Michal Luczaj)
- eeprom: digsy_mtc: Fix 93xx46 driver probe failure (Andy Shevchenko)
- arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E (FUKAUMI Naoki)
- fs/ntfs3: Use kvfree to free memory allocated by kvmalloc (Konstantin Komarov)
- net: tighten bad gso csum offset check in virtio_net_hdr (Willem de Bruijn)
- minmax: reduce min/max macro expansion in atomisp driver (Lorenzo Stoakes)
- arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma (Quentin Schulz)
- mptcp: pm: Fix uaf in __timer_delete_sync (Edward Adam Davis) [Orabug: 37116564] {CVE-2024-46858}
- platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array (Hans de Goede)
- platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses (Hans de Goede) [Orabug: 37116566] {CVE-2024-46859}
- NFS: Avoid unnecessary rescanning of the per-server delegation list (Trond Myklebust)
- NFSv4: Fix clearing of layout segments in layoutreturn (Trond Myklebust)
- Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table (Takashi Iwai)
- drm/msm/adreno: Fix error return if missing firmware-name (Rob Clark)
- platform/surface: aggregator_registry: Add support for Surface Laptop Go 3 (Maximilian Luz)
- scripts: kconfig: merge_config: config files: add a trailing newline (Anders Roxell)
- HID: multitouch: Add support for GT7868Q (Dmitry Savin)
- Input: synaptics - enable SMBus for HP Elitebook 840 G2 (Jonathan Denose)
- Input: ads7846 - ratelimit the spi_sync error message (Marek Vasut)
- btrfs: update target inode's ctime on unlink (Jeff Layton)
- powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL (Christophe Leroy)
- net: phy: vitesse: repair vsc73xx autonegotiation (Pawel Dembicki)
- net: ethernet: use ip_hdrlen() instead of bit shift (Moon Yeounsu)
- usbnet: ipheth: fix carrier detection in modes 1 and 4 (Foster Snowhill)
- ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate (Lizhi Xu) [Orabug: 37200925] {CVE-2024-49877}
- ocfs2: fix null-ptr-deref when journal load failed. (Julian Sun) [Orabug: 37206096] {CVE-2024-49957}
- ocfs2: remove unreasonable unlock in ocfs2_read_blocks (Lizhi Xu) [Orabug: 37206135] {CVE-2024-49965}
- ocfs2: cancel dqi_sync_work before freeing oinfo (Joseph Qi) [Orabug: 37206140] {CVE-2024-49966}
- ocfs2: fix uninit-value in ocfs2_get_block() (Joseph Qi)
- ocfs2: fix the la space leak when unmounting an ocfs2 volume (Heming Zhao)
- mm: krealloc: consider spare memory for __GFP_ZERO (Danilo Krummrich)
- jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit (Kemeng Shi)
- jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error (Baokun Li) [Orabug: 37206108] {CVE-2024-49959}
- drm: omapdrm: Add missing check for alloc_ordered_workqueue (Ma Ke) [Orabug: 37200934] {CVE-2024-49879}
in of_msi_get_domain (Andrew Jones)
- parisc: Fix stack start for ADDR_NO_RANDOMIZE personality (Helge Deller)
- parisc: Fix 64-bit userspace syscall path (Helge Deller)

[5.15.0-302.167.6]
- ice: Add a per-VF limit on number of FDIR filters (Ahmed Zaki)  [Orabug: 36964088]  {CVE-2024-42291}
- scsi: lpfc: Fix a possible null pointer dereference (Huai-Yuan Liu)  [Orabug: 36964437]  {CVE-2024-43821}
- power: reset: pwr-mlxbf: support graceful shutdown (Asmaa Mnebhi)  [Orabug: 37208029]
- gpio: mlxbf3: Support shutdown() function (Asmaa Mnebhi)  [Orabug: 37208029]
- sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove() (Liming Sun)  [Orabug: 37208029]
- ocfs2: reserve space for inline xattr before attaching reflink tree (Gautham Ananthakrishna)  [Orabug: 37199019] {CVE-2024-49958}
- Revert 'ocfs2: ocfs2 crash due to invalid h_next_leaf_blk value in extent block' (Gautham Ananthakrishna)  [Orabug: 37199019]

[5.15.0-302.167.5]
- mm/hugetlb: fix adjusting poison page flag in non-HVO scenario (Jane Chu)  [Orabug: 37182268]
- x86/bugs: Adjust SRSO mitigation to new features (Boris Ostrovsky)  [Orabug: 37145844]
- net/mlx5: disable the 'fast unload' feature on Exadata systems (Qing Huang)  [Orabug: 37093170]
- NFS: remove revoked delegation from server's delegation list (Dai Ngo)  [Orabug: 36990366]
- perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() (Alexander Antonov)  [Orabug: 36882937]  {CVE-2023-52450}

[5.15.0-302.167.4]
- LTS version: v5.15.167 (Vijayendra Suman)
- udp: fix receiving fraglist GSO packets (Felix Fietkau)
- memcg: protect concurrent access to mem_cgroup_idr (Shakeel Butt) [Orabug: 36993003] {CVE-2024-43892}
- btrfs: fix race between direct IO write and fsync when using same fd (Filipe Manana) [Orabug: 37195092] {CVE-2024-46734}
- net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (Daniel Borkmann)
- x86/mm: Fix PTI for i386 some more (Thomas Gleixner)
- net: drop bad gso csum_start and offset in virtio_net_hdr (Willem de Bruijn) [Orabug: 37195028] {CVE-2024-43897}
- gso: fix dodgy bit handling for GSO_UDP_L4 (Yan Zhai)
- net: change maximum number of UDP segments to 128 (Yuri Benditovich)
- net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation (Willem de Bruijn)
- gpio: rockchip: fix OF node leak in probe() (Krzysztof Kozlowski)
- drm/i915/fence: Mark debug_fence_free() with __maybe_unused (Andy Shevchenko)
- drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused (Andy Shevchenko)
- ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode (Matteo Martelli)
- nvmet-tcp: fix kernel crash if commands allocation fails (Maurizio Lombardi) [Orabug: 37074464] {CVE-2024-46737}
- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (Jonathan Cameron) [Orabug: 37116411] {CVE-2024-46822}
- arm64: acpi: Move get_cpu_for_acpi_id() to a header (James Morse)
- ACPI: processor: Fix memory leaks in error paths of processor_add() (Jonathan Cameron)
- ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() (Jonathan Cameron)
- workqueue: Improve scalability of workqueue watchdog touch (Nicholas Piggin) [Orabug: 37116487] {CVE-2024-46839}
- workqueue: wq_watchdog_touch is always called with valid CPU (Nicholas Piggin)
- nilfs2: protect references to superblock parameters exposed in sysfs (Ryusuke Konishi) [Orabug: 37074676] {CVE-2024-46780}
- nilfs2: replace snprintf in show functions with sysfs_emit (Qing Wang)
- ksmbd: Unlock on in ksmbd_tcp_set_interfaces() (Dan Carpenter)
- ksmbd: unset the binding mark of a reused connection (Namjae Jeon) [Orabug: 37074716] {CVE-2024-46795}
- perf/aux: Fix AUX buffer serialization (Peter Zijlstra) [Orabug: 37070802] {CVE-2024-46713}
- uprobes: Use kzalloc to allocate xol area (Sven Schnelle)
- clocksource/drivers/timer-of: Remove percpu irq related code (Daniel Lezcano)
- clocksource/drivers/imx-tpm: Fix next event not taking effect sometime (Jacky Bai)
- clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX (Jacky Bai)
- Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic (Naman Jain)
- uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind (Saurabh Sengar) [Orabug: 37074472] {CVE-2024-46739}
- nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc (Geert Uytterhoeven)
- binder: fix UAF caused by offsets overwrite (Carlos Llamas) [Orabug: 37074476] {CVE-2024-46740}
- usb: dwc3: core: update LC timer as per USB Spec V3.2 (Faisal Hassan)
- iio: adc: ad7124: fix chip ID mismatch (Dumitru Ceclan)
- iio: adc: ad7124: fix config comparison (Dumitru Ceclan)
- iio: fix scale application in iio_convert_raw_to_processed_unlocked (Matteo Martelli)
- iio: buffer-dmaengine: fix releasing dma channel on error (David Lechner)
- staging: iio: frequency: ad9834: Validate frequency parameter value (Aleksandr Mishin) [Orabug: 37159727] {CVE-2024-47663}
- cifs: Check the lease context if we actually got a lease (Ronnie Sahlberg)
- NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations (Trond Myklebust)
- ata: pata_macio: Use WARN instead of BUG (Michael Ellerman)
- MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed (Jiaxun Yang) [Orabug: 37116454] {CVE-2024-46832}
- lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Kent Overstreet) [Orabug: 37159756] {CVE-2024-47668}
- of/irq: Prevent device address out-of-bounds read in interrupt map walk (Stefan Wiehler) [Orabug: 37074487] {CVE-2024-46743}
- Squashfs: sanity check symbolic link size (Phillip Lougher) [Orabug: 37074494] {CVE-2024-46744}
- usbnet: ipheth: race between ipheth_close and error handling (Oliver Neukum)
- Input: uinput - reject requests with unreasonable number of slots (Dmitry Torokhov) [Orabug: 37074502] {CVE-2024-46745}
- HID: amd_sfh: free driver_data after destroying hid device (Olivier Sobrie) [Orabug: 37074507] {CVE-2024-46746}
- HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup (Camila Alvarez) [Orabug: 37074512] {CVE-2024-46747}
- s390/vmlinux.lds.S: Move ro_after_init section behind rodata section (Heiko Carstens)
- btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() (David Sterba)
- kselftests: dmabuf-heaps: Ensure the driver name is null-terminated (Zenghui Yu)
- i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup (Jarkko Nikula) [Orabug: 37159737] {CVE-2024-47665}
- net: dpaa: avoid on-stack arrays of NR_CPUS elements (Vladimir Oltean)
- PCI: Add missing bridge lock to pci_bus_lock() (Dan Williams) [Orabug: 37074530] {CVE-2024-46750}
- riscv: set trap vector earlier (yang.zhang)
- btrfs: replace BUG_ON() with error handling at update_ref_for_cow() (Filipe Manana) [Orabug: 37074542] {CVE-2024-46752}
- btrfs: clean up our handling of refs == 0 in snapshot delete (Josef Bacik) [Orabug: 37116493] {CVE-2024-46840}
- btrfs: replace BUG_ON with ASSERT in walk_down_proc() (Josef Bacik)
- fs/ntfs3: Check more cases when directory is corrupted (Konstantin Komarov)
- smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() (Zqiang)
- wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (Sascha Hauer) [Orabug: 37074560] {CVE-2024-46755}
- dma-mapping: benchmark: Don't starve others when doing the test (Yicong Yang)
- ext4: fix possible tid_t sequence overflows (Luis Henriques (SUSE))
- drm/amdgpu: Set no_hw_access when VF request full GPU fails (Yifan Zha)
- libbpf: Add NULL checks to bpf_object__{prev_map,next_map} (Andreas Ziegler)
- hwmon: (w83627ehf) Fix underflows seen when writing limit attributes (Guenter Roeck) [Orabug: 37074565] {CVE-2024-46756}
- hwmon: (nct6775-core) Fix underflows seen when writing limit attributes (Guenter Roeck) [Orabug: 37074570] {CVE-2024-46757}
- hwmon: (lm95234) Fix underflows seen when writing limit attributes (Guenter Roeck) [Orabug: 37074578] {CVE-2024-46758}
- hwmon: (adc128d818) Fix underflows seen when writing limit attributes (Guenter Roeck) [Orabug: 37074583] {CVE-2024-46759}
- pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv (Krishna Kumar) [Orabug: 37074594] {CVE-2024-46761}
- devres: Initialize an uninitialized struct member (Zijun Hu)
- um: line: always fill *error_out in setup_one_line() (Johannes Berg) [Orabug: 37116517] {CVE-2024-46844}
- cgroup: Protect css-&gt;cgroup write under css_set_lock (Waiman Long)
- iommu/vt-d: Handle volatile descriptor status read (Jacob Pan)
- dm init: Handle minors larger than 255 (Benjamin Marzinski)
- ASoC: topology: Properly initialize soc_enum values (Amadeusz Slawinski)
- net: dsa: vsc73xx: fix possible subblocks range of CAPT block (Pawel Dembicki)
- net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN (Jonas Gorski)
- fou: Fix null-ptr-deref in GRO. (Kuniyuki Iwashima) [Orabug: 37074606] {CVE-2024-46763}
- gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers (Eric Dumazet)
- gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers (Eric Dumazet)
- bareudp: Fix device stats updates. (Guillaume Nault)
- usbnet: modern method to get random MAC (Oliver Neukum)
- net: usb: don't write directly to netdev-&gt;dev_addr (Jakub Kicinski)
- ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset (Larysa Zaremba)
- igc: Unlock on error in igc_io_resume() (Dan Carpenter)
- tcp_bpf: fix return value of tcp_bpf_sendmsg() (Cong Wang) [Orabug: 37074692] {CVE-2024-46783}
- platform/x86: dell-smbios: Fix error path in dell_smbios_init() (Aleksandr Mishin)
- igb: Fix not clearing TimeSync interrupts for 82580 (Daiwei Li)
- can: m_can: Release irq on error in m_can_open (Simon Horman)
- can: bcm: Remove proc entry when dev is unregistered. (Kuniyuki Iwashima) [Orabug: 37074624] {CVE-2024-46771}
- drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6 (Marek Olsak)
- pcmcia: Use resource_size function on resource object (Jules Irenge)
- media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse (Chen Ni)
- PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) (Kishon Vijay Abraham I) [Orabug: 37159749] {CVE-2024-47667}
- media: vivid: don't set HDMI TX controls if there are no HDMI outputs (Hans Verkuil)
- drm/amd/display: Check HDCP returned status (Alex Hung)
- usb: uas: set host status byte on data completion error (Shantanu Goel)
- wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 (Arend van Spriel)
- leds: spi-byte: Call of_node_put() on error path (Andy Shevchenko)
- media: vivid: fix wrong sizeimage value for mplane (Hans Verkuil)
- udf: Avoid excessive partition lengths (Jan Kara) [Orabug: 37074664] {CVE-2024-46777}
- netfilter: nf_conncount: fix wrong variable type (Yunjian Wang)
- iommu: sun50i: clear bypass register (Jernej Skrabec)
- af_unix: Remove put_pid()/put_cred() in copy_peercred(). (Kuniyuki Iwashima)
- irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 (Pali Rohar)
- smack: unix sockets: fix accept()ed socket label (Konstantin Andreev)
- ALSA: hda: Add input value sanity checks to HDMI channel map controls (Takashi Iwai)
- mptcp: pm: send ACK on an active subflow (Matthieu Baerts (NGI0))
- mptcp: pr_debug: add missing
 at the end (Matthieu Baerts (NGI0))
- mptcp: pm: skip connecting to already established sf (Matthieu Baerts (NGI0))
- mptcp: pm: do not remove already closed subflows (Matthieu Baerts (NGI0))
- mptcp: pm: ADD_ADDR 0 is not a new address (Matthieu Baerts (NGI0))
- mptcp: close subflow when receiving TCP+FIN (Matthieu Baerts (NGI0))
- mptcp: avoid duplicated SUB_CLOSED events (Matthieu Baerts (NGI0))
- mptcp: pm: avoid possible UaF when selecting endp (Matthieu Baerts (NGI0))
- mptcp: constify a bunch of of helpers (Paolo Abeni)
- mptcp: pm: fullmesh: select the right ID later (Matthieu Baerts (NGI0))
- mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR (Matthieu Baerts (NGI0))
- mptcp: pm: only decrement add_addr_accepted for MPJ req (Matthieu Baerts (NGI0))
- mptcp: pm: re-using ID of unused flushed subflows (Matthieu Baerts (NGI0))
- nilfs2: fix state management in error path of log writing function (Ryusuke Konishi) [Orabug: 37159764] {CVE-2024-47669}
- nilfs2: fix missing cleanup on rollforward recovery error (Ryusuke Konishi) [Orabug: 37074683] {CVE-2024-46781}
- sched: sch_cake: fix bulk flow accounting logic for host fairness (Toke Hoiland-Jorgensen) [Orabug: 37116442] {CVE-2024-46828}
- ila: call nf_unregister_net_hooks() sooner (Eric Dumazet) [Orabug: 37074688] {CVE-2024-46782}
- tracing: Avoid possible softlockup in tracing_iter_reset() (Zheng Yejian)
- can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open (Simon Arlott) [Orabug: 37074711] {CVE-2024-46791}
- clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API (Satya Priya Kakitapalli)
- clk: qcom: clk-alpha-pll: Fix the pll post div mask (Satya Priya Kakitapalli)
- fuse: use unsigned type for getxattr/listxattr size truncation (Jann Horn)
- fuse: update stats for pages in dropped aux writeback list (Joanne Koong)
- mmc: cqhci: Fix checking of CQHCI_HALT state (Seunghwan Baek)
- mmc: sdhci-of-aspeed: fix module autoloading (Liao Chen)
- mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K (Sam Protsenko)
- Bluetooth: MGMT: Ignore keys being loaded with invalid type (Luiz Augusto von Dentz)
- Revert 'Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE' (Luiz Augusto von Dentz)
- nvme-pci: Add sleep quirk for Samsung 990 Evo (Georg Gottleuber)
- rtmutex: Drop rt_mutex::wait_lock before scheduling (Roland Xu) [Orabug: 37116445] {CVE-2024-46829}
- irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init() (Ma Ke)
- ata: libata: Fix memory leak for error path in ata_host_alloc() (Zheng Qixing)
- ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx (Maximilien Perreault)
- ALSA: hda/realtek: add patch for internal mic in Lenovo V145 (Terry Cheong)
- ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices (Christoffer Sandberg)
- KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing (Ravi Bangoria)
- KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE (Maxim Levitsky)
- ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object (robelin) [Orabug: 37074721] {CVE-2024-46798}
- sch/netem: fix use after free in netem_dequeue (Stephen Hemminger) [Orabug: 37074725] {CVE-2024-46800}
- i2c: Use IS_REACHABLE() for substituting empty ACPI functions (Richard Fitzgerald)
- ext4: handle redirtying in ext4_bio_write_page() (Jan Kara)
- udf: Limit file size to 4TB (Jan Kara)
- ext4: reject casefold inode flag without casefold feature (Eric Biggers)
- rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow (Nikita Kiryushin) [Orabug: 36753533] {CVE-2024-38577}
- virtio_net: Fix napi_skb_cache_put warning (Breno Leitao) [Orabug: 36964473] {CVE-2024-43835}
- drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr (Bob Zhou) [Orabug: 36993065] {CVE-2024-43905}
- media: uvcvideo: Enforce alignment of frame and interval (Ricardo Ribalda)
- drm/amd/display: Skip wbscl_set_scaler_filter if filter is null (Alex Hung) [Orabug: 37073031] {CVE-2024-46714}
- block: remove the blk_flush_integrity call in blk_integrity_unregister (Christoph Hellwig)
- wifi: cfg80211: make hash table duplicates more survivable (Johannes Berg)
- drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ (Marek Vasut) [Orabug: 37116336] {CVE-2024-46810}
- drm/meson: plane: Add error handling (Haoran Liu)
- smack: tcp: ipv4, fix incorrect labeling (Casey Schaufler)
- usb: typec: ucsi: Fix null pointer dereference in trace (Abhishek Pandit-Subedi) [Orabug: 37073064] {CVE-2024-46719}
- usbip: Don't submit special requests twice (Simon Holesch)
- rcu/nocb: Remove buggy bypass lock contention mitigation (Frederic Weisbecker)
- ionic: fix potential irq name truncation (Shannon Nelson)
- RDMA/efa: Properly handle unexpected AQ completions (Michael Margolin)
- hwspinlock: Introduce hwspin_lock_bust() (Richard Maina)
- PCI: al: Check IORESOURCE_BUS existence during probe (Aleksandr Mishin)
- cpufreq: scmi: Avoid overflow of target_freq in fast switch (Jagadeesh Kona)
- wifi: iwlwifi: remove fw_running op (Shahar S Matityahu)
- drm/amdgpu: update type of buf size to u32 for eeprom functions (Tao Zhou)
- drm/amd/pm: check negtive return for table entries (Jesse Zhang)
- drm/amdgpu: the warning dereferencing obj for nbio_v7_4 (Jesse Zhang) [Orabug: 37116393] {CVE-2024-46819}
- drm/amd/pm: check specific index for aldebaran (Jesse Zhang)
- drm/amdgpu: fix the waring dereferencing hive (Jesse Zhang) [Orabug: 37116300] {CVE-2024-46805}
- drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs (Ma Jun)
- apparmor: fix possible NULL pointer dereference (Leesoo Ahn) [Orabug: 37073077] {CVE-2024-46721}
- drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device (Michael Chen)
- drm/amdgpu: fix mc_data out-of-bounds read warning (Tim Huang) [Orabug: 37073082] {CVE-2024-46722}
- drm/amdgpu: fix ucode out-of-bounds read warning (Tim Huang) [Orabug: 37073087] {CVE-2024-46723}
- drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (Ma Jun) [Orabug: 37073093] {CVE-2024-46724}
- drm/amdgpu: Fix out-of-bounds write warning (Ma Jun) [Orabug: 37073098] {CVE-2024-46725}
- drm/amdgpu/pm: Fix uninitialized variable agc_btc_response (Ma Jun)
- drm/amdgpu/pm: Fix uninitialized variable warning for smu10 (Ma Jun)
- drm/amd/amdgpu: Check tbo resource pointer (Asad Kamal) [Orabug: 37116315] {CVE-2024-46807}
- drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create (Hersen Wu)
- drm/amd/display: Check msg_id before processing transcation (Alex Hung) [Orabug: 37116360] {CVE-2024-46814}
- drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] (Alex Hung) [Orabug: 37116365] {CVE-2024-46815}
- drm/amd/display: Add array index check for hdcp ddc access (Hersen Wu) [Orabug: 37116295] {CVE-2024-46804}
- drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (Hersen Wu) [Orabug: 37116375] {CVE-2024-46817}
- drm/amd/display: Check gpio_id before used as array index (Alex Hung) [Orabug: 37116384] {CVE-2024-46818}
- drm/amdgpu: avoid reading vf2pf info size from FB (Zhigang Luo)
- drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr (Tim Huang)
- drm/amdgpu: fix uninitialized scalar variable warning (Tim Huang)
- drm/amd/pm: fix the Out-of-bounds read warning (Jesse Zhang) [Orabug: 37073129] {CVE-2024-46731}
- drm/amd/pm: fix warning using uninitialized value of max_vid_step (Jesse Zhang)
- drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr (Tim Huang)
- drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc (Ma Jun)
- drm/amdgpu: fix overflowed array index read warning (Tim Huang)
- drm/amd/display: Assign linear_pitch_alignment even for VM (Alvin Lee) [Orabug: 37073135] {CVE-2024-46732}
- drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr (Ma Jun)
- net: usb: qmi_wwan: add MeiG Smart SRM825L (ZHANG Yuntian)
- dma-debug: avoid deadlock between dma debug vs printk and netconsole (Rik van Riel)
- i2c: Fix conditional for substituting empty ACPI functions (Richard Fitzgerald)
- ALSA: hda/conexant: Mute speakers at suspend / shutdown (Takashi Iwai)
- ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown (Takashi Iwai)
- drm: panel-orientation-quirks: Add quirk for OrangePi Neo (Philip Mueller)
- LTS version: v5.15.166 (Vijayendra Suman)
- apparmor: fix policy_unpack_test on big endian systems (Guenter Roeck)
- scsi: aacraid: Fix double-free on probe failure (Ben Hutchings) [Orabug: 37070699] {CVE-2024-46673}
- igc: Fix qbv tx latency by setting gtxoffset (Faizal Rahim)
- igc: Fix reset adapter logics when tx mode change (Faizal Rahim)
- phy: zynqmp: Enable reference clock correctly (Sean Anderson)
- usb: cdnsp: fix for Link TRB with TC (Pawel Laszczak)
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function (Pawel Laszczak)
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() (Zijun Hu)
- usb: dwc3: st: add missing depopulate in probe error path (Krzysztof Kozlowski)
- usb: dwc3: st: fix probed platform device ref count on probe error path (Krzysztof Kozlowski) [Orabug: 37070704] {CVE-2024-46674}
- usb: dwc3: core: Prevent USB core invalid event buffer address access (Selvarasu Ganesan) [Orabug: 37070709] {CVE-2024-46675}
- usb: dwc3: omap: add missing depopulate in probe error path (Krzysztof Kozlowski)
- USB: serial: option: add MeiG Smart SRM825L (ZHANG Yuntian)
- cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller (Ian Ray)
- soc: qcom: cmd-db: Map shared memory as WC, not WB (Volodymyr Babchuk)
- nfc: pn533: Add poll mod list filling check (Aleksandr Mishin) [Orabug: 37070716] {CVE-2024-46676}
- net: busy-poll: use ktime_get_ns() instead of local_clock() (Eric Dumazet)
- gtp: fix a potential NULL pointer dereference (Cong Wang) [Orabug: 37070721] {CVE-2024-46677}
- ethtool: check device is present when getting link settings (Jamie Bainbridge) [Orabug: 37070727] {CVE-2024-46679}
- dmaengine: dw: Add memory bus width verification (Serge Semin)
- dmaengine: dw: Add peripheral bus width verification (Serge Semin)
- phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume (Piyush Mehta)
- phy: xilinx: phy-zynqmp: dynamic clock support for power-save (Piyush Mehta)
- phy: xilinx: add runtime PM support (Piyush Mehta)
- PM: runtime: Add DEFINE_RUNTIME_DEV_PM_OPS() macro (Paul Cercueil)
- PM: core: Add EXPORT[_GPL]_SIMPLE_DEV_PM_OPS macros (Paul Cercueil)
- PM: core: Remove DEFINE_UNIVERSAL_DEV_PM_OPS() macro (Paul Cercueil)
- soundwire: stream: fix programming slave ports for non-continous port maps (Krzysztof Kozlowski)
- cgroup/cpuset: Prevent UAF in proc_cpuset_show() (Chen Ridong) [Orabug: 36964509] {CVE-2024-43853}
- ata: libata-core: Fix null pointer dereference on error (Niklas Cassel) [Orabug: 36897456] {CVE-2024-41098}
- drm/amdkfd: don't allow mapping the MMIO HDP page with large pages (Alex Deucher) [Orabug: 36867630] {CVE-2024-41011}
- Revert 'MIPS: Loongson64: reset: Prioritise firmware service' (Greg Kroah-Hartman)
- mptcp: sched: check both backup in retrans (Matthieu Baerts (NGI0))
- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (Haiyang Zhang)
- wifi: mwifiex: duplicate static structs used in driver instances (Sascha Hauer)
- pinctrl: single: fix potential NULL dereference in pcs_get_function() (Ma Ke) [Orabug: 37070743] {CVE-2024-46685}
- pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins (Huang-Huang Bao)
- btrfs: run delayed iputs when flushing delalloc (Josef Bacik)
- drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Jesse Zhang) [Orabug: 36898008] {CVE-2024-42228}
(Alexander Lobakin)
- Input: MT - limit max slots (Tetsuo Handa) [Orabug: 37029136] {CVE-2024-45008}
- Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO (Lee, Chun-Yi) [Orabug: 35358656] {CVE-2023-31083}
- mm/numa: no task_numa_fault() call if PTE is changed (Zi Yan)
- mm/numa: no task_numa_fault() call if PMD is changed (Zi Yan)
- ALSA: timer: Relax start tick time check for slave timer elements (Takashi Iwai)
- hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() (Javier Carrasco)
- Revert 'drm/amd/display: Validate hw_points_num before using it' (Alex Hung)
- mmc: dw_mmc: allow biu and ciu clocks to defer (Ben Whitten)
- KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 (Marc Zyngier) [Orabug: 37070792] {CVE-2024-46707}
- cxgb4: add forgotten u64 ivlan cast before shift (Nikolay Kuratov)
- HID: microsoft: Add rumble support to latest xbox controllers (Siarhei Vishniakou)
- HID: wacom: Defer calculation of resolution until resolution_code is known (Jason Gerecke)
- MIPS: Loongson64: Set timer mode in cpu-probe (Jiaxun Yang)
- scsi: core: Fix the return value of scsi_logical_block_count() (Chaotian Jing)
- Bluetooth: MGMT: Add error handling to pair_device() (Griffin Kroah-Hartman) [Orabug: 36992975] {CVE-2024-43884}
- mmc: mmc_test: Fix NULL dereference on allocation failure (Dan Carpenter) [Orabug: 37070690] {CVE-2024-45028}
- drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails (Dmitry Baryshkov) [Orabug: 37029059] {CVE-2024-44982}
- drm/msm/dp: reset the link phy params before link training (Abhinav Kumar)
- drm/msm/dpu: don't play tricks with debug macros (Dmitry Baryshkov)
- net: xilinx: axienet: Fix dangling multicast addresses (Sean Anderson)
- net: xilinx: axienet: Always disable promiscuous mode (Sean Anderson)
- netfilter: flowtable: validate vlan header (Pablo Neira Ayuso) [Orabug: 37029063] {CVE-2024-44983}
- ipv6: prevent possible UAF in ip6_xmit() (Eric Dumazet) [Orabug: 37029066] {CVE-2024-44985}
...</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2025-20205.html" type="self" title="ELBA-2025-20205" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="kernel-uek" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="src">
          <filename>kernel-uek-5.15.0-303.171.5.2.2.el9uek.src.rpm</filename>
          <sum type="sha256">0e7bdb2152dc0ac8bb80165b343180465c3141ee3c001e79a98d818d8c80f138</sum>
        </package>
        <package name="kernel-uek-debug-modules" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-modules-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">cab133e90514a9a55ade8d7b8027ae0a59d4c987e3c2c72dcdb9e10915157f37</sum>
        </package>
        <package name="kernel-uek-debug" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">f15194fc5feefb842c07dfd50086041e55a83c1d8caf71545042055b3739750c</sum>
        </package>
        <package name="kernel-uek-modules" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-modules-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">f043215405105466b67c794c0d0e7f9fd2f855a29bfb9e616f08ec99552fe50c</sum>
        </package>
        <package name="kernel-uek-doc" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="noarch">
          <filename>kernel-uek-doc-5.15.0-303.171.5.2.2.el9uek.noarch.rpm</filename>
          <sum type="sha256">12017418e407e1c60ebcfa315badb4dfccecb40d7ef0c96cdd752c78c628d411</sum>
        </package>
        <package name="kernel-uek-debug-devel" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-devel-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">95a34e309616310a0aaa7d93c5769b2d4b6c51de9df2bde9cf49fcbde705010f</sum>
        </package>
        <package name="kernel-uek-modules-extra" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-modules-extra-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">53de5e911fb24ef7f98400f168ec7561434482bff96e468da2b7879967db3991</sum>
        </package>
        <package name="kernel-uek-debug-core" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-core-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">08c1f34df240edb54397640e533901f82aaf5bd2ac5e5d693f891fb051a244b2</sum>
        </package>
        <package name="kernel-uek-devel" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-devel-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">74f7806cbf1b68f3b600f5d7c98e0ae14451bb98a100ca1bca8b70e7e864d697</sum>
        </package>
        <package name="kernel-uek-core" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-core-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">010583563258faa02c1a048cc6f74ba31c1b31e98c3f3f547621ae4004f001ed</sum>
        </package>
        <package name="kernel-uek-debug-modules-extra" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-modules-extra-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">eceb244bd5c65ba71c2590adb4f1add13e7395c1bd9ce5a8f36c886bebd47f73</sum>
        </package>
        <package name="kernel-uek" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">61c5594b6a8445e1b67a05dbb5cccfe9c89616916d27ac96499430fba940ecb5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2025-20277</id>
    <title> Unbreakable Enterprise kernel bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2025-04-18 00:00:00"/>
    <updated date="2025-04-18 00:00:00"/>
    <rights>Copyright 2025 Oracle, Inc.</rights>
    <description>[5.15.0-303.171.5.2.2]
- Uek-rpm/ol9: Enable CONFIG_FIPS_SIGNATURE_SELFTEST for mips64 (Vijay Kumar)  [Orabug: 37509583] 
- uek-rpm: Enable CONFIG_FIPS_SIGNATURE_SELFTEST for all archs (Saeed Mirzamohammadi)  [Orabug: 37509575] 
- Revert 'crypto: jitter - permanent and intermittent health errors' (Saeed Mirzamohammadi)  [Orabug: 37492621] 
- Revert 'crypto: jitter - correct health test during initialization' (Saeed Mirzamohammadi)  [Orabug: 37492621]

[5.15.0-303.171.5.2.1]
- cgroup: cgroup-v1: do not exclude cgrp_dfl_root (Vishal Verma)  [Orabug: 37410450]
- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37423790]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37423790]

[5.15.0-303.171.5.2]
- build: populate modules_thick.builtin for dirs containing only modules (Nick Alcock)  [Orabug: 37393454]
- x86/pkeys: Ensure updated PKRU value is XRSTOR'd (Aruna Ramakrishna)  [Orabug: 37384237]
- x86/pkeys: Change caller of update_pkru_in_sigframe() (Aruna Ramakrishna)  [Orabug: 37384237]
- Revert 'ocfs2: fix the la space leak when unmounting an ocfs2 volume' (Sherry Yang)  [Orabug: 37383283]

[5.15.0-303.171.5.1]
- sunrpc: fix a NULL deref in svc_process() when -&gt;sv_stats doesn't exist (Calum Mackay)  [Orabug: 37346134]

[5.15.0-303.171.5]
- intel_idle: fix ACPI _CST matching for newer Xeon platforms (Artem Bityutskiy)  [Orabug: 37249457]
- x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram (Peter Zijlstra)  [Orabug: 37249457]
- perf/tests: Add AMX instructions to x86 instruction decoder test (Adrian Hunter)  [Orabug: 37249457]
- x86/insn: Add AMX instructions to the x86 instruction decoder (Adrian Hunter)  [Orabug: 37249457]
- intel_idle: add Granite Rapids Xeon support (Artem Bityutskiy)  [Orabug: 37249457]
- cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again* (Peter Zijlstra)  [Orabug: 37249457]
- intel_idle: Fix false positive RCU splats due to incorrect hardirqs state (Waiman Long)  [Orabug: 37249457]
- cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE (Peter Zijlstra)  [Orabug: 37249457]
- intel_idle: Add a new flag to initialize the AMX state (Chang S. Bae)  [Orabug: 37249457]
- x86/fpu: Add a helper to prepare AMX state for low-power CPU idle (Chang S. Bae)  [Orabug: 37249457]
- intel_idle: enable interrupts before C1 on Xeons (Artem Bityutskiy)  [Orabug: 37249457]

[5.15.0-303.171.4]
- rds: recv_payload_bad_checksum was not 0 after running rds-stress on UEK6 (William Kucharski)  [Orabug: 37265126]
- rds: If RDS Checksums are enabled for RDMA RDS operations, the extension headers will overflow causing incorrect operation (William Kucharski)  [Orabug: 37265124]
- rds: rds_message_alloc() needlessly zeroes m_used_sgs (William Kucharski)  [Orabug: 37265122]
- rds: tracepoint in rds_receive_csum_err() prints pointless information (William Kucharski)  [Orabug: 37265120]
- rds: rds_inc_init() should initialize the inc-&gt;i_conn_path field (William Kucharski)  [Orabug: 37265116]
- rds: Race condition in adding RDS payload checksum extension header may result in RDS header corruption (William Kucharski)  [Orabug: 37265114]
- Revert 'net/mlx5: disable the 'fast unload' feature on Exadata systems' (Qing Huang)  [Orabug: 37285222]
- Revert 'net/mlx5: pretend 'fast unload' succeeded on Exadata systems' (Qing Huang)  [Orabug: 37285222]
- RDMA/mlx5: Fix Shared PD prefetch of ODP memory region (Mark Haywood)  [Orabug: 31688618] [Orabug: 37279176]
- blk-mq: fix missing blk_account_io_done() in error path (Yu Kuai)  [Orabug: 37228086]
- rds: Add rds stuck shutdown timeout (Rohit Nair)  [Orabug: 37214078]
- KVM: x86: Stop compiling vmenter.S with OBJECT_FILES_NON_STANDARD (Sean Christopherson)  [Orabug: 37273739]
- KVM: SVM: Create a stack frame in __svm_sev_es_vcpu_run() (Sean Christopherson)  [Orabug: 37273739]
- KVM: SVM: Create a stack frame in __svm_vcpu_run() for unwinding (Sean Christopherson)  [Orabug: 37273739]
- mm/memory-failure: pass the folio and the page to collect_procs() (Matthew Wilcox (Oracle))  [Orabug: 37270260]
- LTS version: v5.15.171 (Vijayendra Suman)
- mac80211: always have ieee80211_sta_restart() (Johannes Berg)
- vt: prevent kernel-infoleak in con_font_get() (Jeongjun Park)
- drm/i915: Fix potential context UAFs (Rob Clark)
- Revert 'drm/mipi-dsi: Set the fwnode for mipi_dsi_device' (Jason-JH.Lin)
- mm: shmem: fix data-race in shmem_getattr() (Jeongjun Park) [Orabug: 37268580] {CVE-2024-50228}
- wifi: iwlwifi: mvm: fix 6 GHz scan construction (Johannes Berg) [Orabug: 37304734] {CVE-2024-53055}
- nilfs2: fix kernel bug due to missing clearing of checked flag (Ryusuke Konishi) [Orabug: 37268588] {CVE-2024-50230}
- x86/bugs: Use code segment selector for VERW operand (Pawan Gupta) [Orabug: 37227383] {CVE-2024-50072}
- ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (Edward Adam Davis) [Orabug: 37268563] {CVE-2024-50218}
- mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves (Matt Fleming) [Orabug: 37268568] {CVE-2024-50219}
- mm/page_alloc: explicitly define how __GFP_HIGH non-blocking allocations accesses reserves (Mel Gorman)
- mm/page_alloc: explicitly define what alloc flags deplete min reserves (Mel Gorman)
- mm/page_alloc: explicitly record high-order atomic allocations in alloc_flags (Mel Gorman)
- mm/page_alloc: treat RT tasks similar to __GFP_HIGH (Mel Gorman)
- mm/page_alloc: rename ALLOC_HIGH to ALLOC_MIN_RESERVE (Mel Gorman)
- mm/page_alloc: split out buddy removal code from rmqueue into separate helper (Mel Gorman)
- mm/page_alloc: fix tracepoint mm_page_alloc_zone_locked() (Wonhyuk Yang)
- mm/page_alloc: call check_new_pages() while zone spinlock is not held (Eric Dumazet)
- riscv: Remove duplicated GET_RM (Chunyan Zhang)
- riscv: Remove unused GENERATING_ASM_OFFSETS (Chunyan Zhang)
- riscv: Use '%u' to format the output of 'cpu' (WangYuli)
- riscv: efi: Set NX compat flag in PE/COFF header (Heinrich Schuchardt)
- riscv: vdso: Prevent the compiler from inserting calls to memset() (Alexandre Ghiti)
- nilfs2: fix potential deadlock with newly created symlinks (Ryusuke Konishi) [Orabug: 37268584] {CVE-2024-50229}
- iio: light: veml6030: fix microlux value calculation (Javier Carrasco)
- iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr() (Zicheng Qu) [Orabug: 37268595] {CVE-2024-50232}
- staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() (Zicheng Qu) [Orabug: 37268597] {CVE-2024-50233}
- wifi: iwlegacy: Clear stale interrupts before resuming device (Ville Syrjala) [Orabug: 37268602] {CVE-2024-50234}
- wifi: ath10k: Fix memory leak in management tx (Manikanta Pubbisetty) [Orabug: 37268610] {CVE-2024-50236}
- wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (Felix Fietkau) [Orabug: 37268613] {CVE-2024-50237}
- xhci: Use pm_runtime_get to prevent RPM on unsupported systems (Basavaraj Natikar)
- xhci: Fix Link TRB DMA in command ring stopped completion event (Faisal Hassan)
- usb: typec: fix unreleased fwnode_handle in typec_port_register_altmodes() (Javier Carrasco)
- usb: phy: Fix API devm_usb_put_phy() can not release the phy (Zijun Hu)
- usbip: tools: Fix detach_port() invalid port error path (Zongmin Zhou)
- misc: sgi-gru: Don't disable preemption in GRU driver (Dimitri Sivanich)
- net: amd: mvme147: Fix probe banner message (Daniel Palmer)
- scsi: scsi_transport_fc: Allow setting rport state to current state (Benjamin Marzinski)
- fs/ntfs3: Additional check in ni_clear() (Konstantin Komarov) [Orabug: 37268638] {CVE-2024-50244}
- fs/ntfs3: Fix possible deadlock in mi_read (Konstantin Komarov) [Orabug: 37268644] {CVE-2024-50245}
- fs/ntfs3: Fix warning possible deadlock in ntfs_set_state (Konstantin Komarov)
- fs/ntfs3: Check if more than chunk-size bytes are written (Andrew Ballance) [Orabug: 37268655] {CVE-2024-50247}
- firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() (Xiongfeng Wang)
- netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (Pablo Neira Ayuso) [Orabug: 37268670] {CVE-2024-50251}
- net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension (Benoit Monin)
- netfilter: Fix use-after-free in get_info() (Dong Chenchen) [Orabug: 37268689] {CVE-2024-50257}
- bpf: Fix out-of-bounds write in trie_get_next_key() (Byeonguk Jeong) [Orabug: 37268702] {CVE-2024-50262}
- netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (Zichen Xie) [Orabug: 37268697] {CVE-2024-50259}
- net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (Pedro Tammela) [Orabug: 37304740] {CVE-2024-53057}
- net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (Furong Xu) [Orabug: 37304745] {CVE-2024-53058}
- ASoC: cs42l51: Fix some error handling paths in cs42l51_probe() (Christophe JAILLET)
- wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() (Daniel Gabay) [Orabug: 37304749] {CVE-2024-53059}
- wifi: iwlwifi: mvm: disconnect station vifs if recovery failed (Emmanuel Grumbach)
- mac80211: Add support to trigger sta disconnect on hardware restart (Youghandhar Chintala)
- mac80211: do drv_reconfig_complete() before restarting all (Johannes Berg)
- RDMA/bnxt_re: synchronize the qp-handle table array (Selvin Xavier)
- RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down (Patrisious Haddad)
- RDMA/cxgb4: Dump vendor specific QP details (Leon Romanovsky)
- wifi: brcm80211: BRCM_TRACING should depend on TRACING (Geert Uytterhoeven)
- wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys (Felix Fietkau)
- mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING (Geert Uytterhoeven)
- cgroup: Fix potential overflow issue when checking max_depth (Xiu Jianfeng)
- ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context (Koba Ko) [Orabug: 37264072] {CVE-2024-50141}
- ACPI: PRM: Change handler_addr type to void pointer (Sudeep Holla)
- ACPI: PRM: Remove unnecessary blank lines (Aubrey Li)
- ksmbd: fix user-after-free from session log off (Namjae Jeon) [Orabug: 37227413] {CVE-2024-50086}
- selftests/mm: fix incorrect buffer-&gt;mirror size in hmm2 double_map test (Donet Tom)
- LTS version: v5.15.170 (Vijayendra Suman)
- xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [Orabug: 37264074] {CVE-2024-50142}
- ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() (Zichen Xie) [Orabug: 37252324] {CVE-2024-50103}
- net: phy: dp83822: Fix reset pin definitions (Michel Alex)
- serial: protect uart_port_dtr_rts() in uart_shutdown() too (Jiri Slaby (SUSE))
- selinux: improve error checking in sel_write_load() (Paul Moore)
- hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event (Haiyang Zhang)
- xfrm: fix one more kernel-infoleak in algo dumping (Petr Vaganov) [Orabug: 37252349] {CVE-2024-50110}
- ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 (Jose Relvas)
- KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (Sean Christopherson) [Orabug: 37252372] {CVE-2024-50115}
- openat2: explicitly return -E2BIG for (usize &gt; PAGE_SIZE) (Aleksa Sarai)
- nilfs2: fix kernel bug due to missing clearing of buffer delay flag (Ryusuke Konishi) [Orabug: 37252377] {CVE-2024-50116}
- ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue (Shubham Panwar)
- ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] (Christian Heusel)
- drm/amd: Guard against bad data for ATIF ACPI method (Mario Limonciello) [Orabug: 37252383] {CVE-2024-50117}
- btrfs: zoned: fix zone unusable accounting for freed reserved extent (Naohiro Aota)
- ALSA: hda/realtek: Update default depop procedure (Kailang Yang)
- ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (Andrey Shumilin) [Orabug: 37264274] {CVE-2024-50205}
- bpf,perf: Fix perf_event_detach_bpf_prog error handling (Jiri Olsa)
- posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() (Jinjie Ruan) [Orabug: 37320233] {CVE-2024-50210}
- r8169: avoid unsolicited interrupts (Heiner Kallweit)
- net: sched: fix use-after-free in taprio_change() (Dmitry Antipov) [Orabug: 37252407] {CVE-2024-50127}
- net: wwan: fix global oob in wwan_rtnl_policy (Lin Ma) [Orabug: 37252410] {CVE-2024-50128}
- net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x (Peter Rashleigh)
- net: plip: fix break; causing plip to never transmit (Jakub Boehm)
- be2net: fix potential memory leak in be_xmit() (Wang Hai) [Orabug: 37264143] {CVE-2024-50167}
- net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() (Wang Hai) [Orabug: 37264149] {CVE-2024-50168}
- xfrm: respect ip protocols rules criteria when performing dst lookups (Eyal Birger)
- xfrm: extract dst lookup parameters into a struct (Eyal Birger)
- tracing: Consider the NULL character when validating the event length (Leo Yan) [Orabug: 37252415] {CVE-2024-50131}
- platform/x86: dell-sysman: add support for alienware products (Crag Wang)
- ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string (Alexey Klimov)
- arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (junhua huang)
- platform/x86: dell-wmi: Ignore suspend notifications (Armin Wolf)
- udf: fix uninit-value use in udf_get_fileshortad (Gianfranco Trad) [Orabug: 37264080] {CVE-2024-50143}
- arm64: Force position-independent veneers (Mark Rutland)
- ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit (Shengjiu Wang)
- ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values (Alexey Klimov)
- drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA (Hans de Goede) [Orabug: 37252420] {CVE-2024-50134}
- exec: don't WARN for racy path_noexec check (Mateusz Guzik) [Orabug: 37206344] {CVE-2024-50010}
- XHCI: Separate PORT and CAPs macros into dedicated file (Frank Li)
- usb: gadget: Add function wakeup support (Elson Roy Serrao)
- KVM: s390: gaccess: Check if guest address is in memslot (Nico Boehr)
- KVM: s390: gaccess: Cleanup access to guest pages (Janis Schoetterl-Glausch)
- KVM: s390: gaccess: Refactor access address range check (Janis Schoetterl-Glausch)
- KVM: s390: gaccess: Refactor gpa and length calculation (Janis Schoetterl-Glausch)
- arm64: probes: Fix uprobes for big-endian kernels (Mark Rutland) [Orabug: 37264236] {CVE-2024-50194}
- arm64:uprobe fix the uprobe SWBP_INSN in big-endian (junhua huang)
- Bluetooth: bnep: fix wild-memory-access in proto_unregister (Ye Bin) [Orabug: 37264096] {CVE-2024-50148}
- s390: Initialize psw mask in perf_arch_fetch_caller_regs() (Heiko Carstens)
- usb: typec: altmode should keep reference to parent (Thadeu Lima de Souza Cascardo) [Orabug: 37264102] {CVE-2024-50150}
- smb: client: fix OOBs when building SMB2_IOCTL request (Paulo Alcantara) [Orabug: 37264107] {CVE-2024-50151}
- scsi: target: core: Fix null-ptr-deref in target_alloc_device() (Wang Hai) [Orabug: 37264112] {CVE-2024-50153}
- genetlink: hold RCU in genlmsg_mcast() (Eric Dumazet)
- tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Kuniyuki Iwashima) [Orabug: 37264114] {CVE-2024-50154}
- net: systemport: fix potential memory leak in bcm_sysport_xmit() (Wang Hai) [Orabug: 37264156] {CVE-2024-50171}
- net: xilinx: axienet: fix potential memory leak in axienet_start_xmit() (Wang Hai)
- net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid (Li RongQing)
- net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() (Wang Hai)
- macsec: don't increment counters for an unrelated SA (Sabrina Dubroca)
- net: usb: usbnet: fix race in probe failure (Oliver Neukum)
- drm/msm: Allocate memory for disp snapshot with kvzalloc() (Douglas Anderson)
- drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() (Douglas Anderson) [Orabug: 37264122] {CVE-2024-50156}
- drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation (Jonathan Marek)
- RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (Bhargava Chenna Marreddy) [Orabug: 37264280] {CVE-2024-50208}
- RDMA/bnxt_re: Return more meaningful error (Kalesh AP)
- ipv4: give an IPv4 dev to blackhole_netdev (Xin Long)
- RDMA/irdma: Fix misspelling of 'accept*' (Alexander Zubkov)
- RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Anumula Murali Mohan Reddy)
- ALSA: hda/cs8409: Fix possible NULL dereference (Murad Masimov) [Orabug: 37264129] {CVE-2024-50160}
- ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin (Florian Klink)
- x86/resctrl: Avoid overflow in MB settings in bw_validate() (Martin Kletzander)
- RDMA/bnxt_re: Add a check for memory allocation (Kalesh AP) [Orabug: 37264285] {CVE-2024-50209}
- RDMA/bnxt_re: Fix incorrect AVID type in WQE structure (Saravanan Vajravel)
- bpf: devmap: provide rxq after redirect (Florian Kauer) [Orabug: 37264132] {CVE-2024-50162}
- bpf: Make sure internal and UAPI bpf_redirect flags don't overlap (Toke Hoiland-Jorgensen) [Orabug: 37264134] {CVE-2024-50163}
- LTS version: v5.15.169 (Vijayendra Suman)
- ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 (Vasiliy Kovalev)
- powerpc/mm: Always update max/min_low_pfn in mem_topology_setup() (Aneesh Kumar K.V)
- nilfs2: propagate directory read errors from nilfs_find_entry() (Ryusuke Konishi) [Orabug: 37264266] {CVE-2024-50202}
- mptcp: prevent MPC handshake on port-based signal endpoints (Paolo Abeni)
- mptcp: fallback when MPTCP opts are dropped after 1st data (Matthieu Baerts (NGI0))
- tcp: fix mptcp DSS corruption due to large pmtu xmit (Paolo Abeni) [Orabug: 37227408] {CVE-2024-50083}
- mptcp: handle consistently DSS corruption (Paolo Abeni) [Orabug: 37264210] {CVE-2024-50185}
- mptcp: track and update contiguous data status (Geliang Tang)
- irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Marc Zyngier) [Orabug: 37264231] {CVE-2024-50192}
- pinctrl: ocelot: fix system hang on level based interrupts (Sergey Matsievskiy) [Orabug: 37264246] {CVE-2024-50196}
- x86/entry_32: Clear CPU buffers after register restore in NMI return (Pawan Gupta) [Orabug: 37264234] {CVE-2024-50193}
- x86/entry_32: Do not clobber user EFLAGS.ZF (Pawan Gupta)
- x86/apic: Always explicitly disarm TSC-deadline timer (Zhang Rui)
- x86/resctrl: Annotate get_mem_config() functions as __init (Nathan Chancellor)
- USB: serial: option: add Telit FN920C04 MBIM compositions (Daniele Palmas)
- USB: serial: option: add support for Quectel EG916Q-GL (Benjamin B. Frost)
- xhci: Mitigate failed set dequeue pointer commands (Mathias Nyman)
- xhci: Fix incorrect stream context type macro (Mathias Nyman)
- Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 (Luiz Augusto von Dentz)
- Bluetooth: Remove debugfs directory on module init failure (Aaron Thompson)
- iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig (Javier Carrasco)
- iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig (Javier Carrasco)
- iio: light: opt3001: add missing full-scale range value (Emil Gedenryd)
- iio: light: veml6030: fix IIO device retrieval from embedded device (Javier Carrasco) [Orabug: 37264254] {CVE-2024-50198}
- iio: light: veml6030: fix ALS sensor resolution (Javier Carrasco)
- iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() (Christophe JAILLET)
- iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig (Javier Carrasco)
- iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig (Javier Carrasco)
- iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig (Javier Carrasco)
- iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig (Javier Carrasco)
- drm/vmwgfx: Handle surface check failure correctly (Nikolay Kuratov)
- drm/radeon: Fix encoder-&gt;possible_clones (Ville Syrjala) [Orabug: 37264263] {CVE-2024-50201}
- io_uring/sqpoll: close race on waiting for sqring entries (Jens Axboe)
- blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Omar Sandoval) [Orabug: 37227403] {CVE-2024-50082}
- x86/bugs: Do not use UNTRAIN_RET with IBPB on entry (Johannes Wikner)
- x86/bugs: Skip RSB fill at VMEXIT (Johannes Wikner)
- x86/entry: Have entry_ibpb() invalidate return predictions (Johannes Wikner)
- x86/cpufeatures: Add a IBPB_NO_RET BUG flag (Johannes Wikner)
- x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET (Jim Mattson)
- KVM: s390: Change virtual to physical address access in diag 0x258 handler (Michael Mueller)
- s390/sclp_vt220: Convert newlines to CRLF instead of LFCR (Thomas Weissschuh)
- iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices (Lu Baolu) [Orabug: 37252321] {CVE-2024-50101}
- io_uring/sqpoll: do not put cpumask on stack (Felix Moessbauer)
- io_uring/sqpoll: retain test for whether the CPU is valid (Jens Axboe)
- io_uring/sqpoll: do not allow pinning outside of cpuset (Felix Moessbauer)
- drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (Wachowski, Karol)
- KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (Breno Leitao) [Orabug: 36835836] {CVE-2024-40953}
- dm-crypt, dm-verity: disable tasklets (Mikulas Patocka)
- wifi: mac80211: fix potential key use-after-free (Johannes Berg)
- secretmem: disable memfd_secret() if arch cannot set direct map (Patrick Roy) [Orabug: 37264195] {CVE-2024-50182}
- mm/swapfile: skip HugeTLB pages for unuse_vma (Liu Shixin) [Orabug: 37264256] {CVE-2024-50199}
- fat: fix uninitialized variable (OGAWA Hirofumi)
- irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 (Nianyao Tang)
- net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY (Oleksij Rempel)
- arm64: probes: Fix simulate_ldr*_literal() (Mark Rutland)
- arm64: probes: Remove broken LDR (literal) uprobe support (Mark Rutland) [Orabug: 37252316] {CVE-2024-50099}
- posix-clock: Fix missing timespec64 check in pc_clock_settime() (Jinjie Ruan) [Orabug: 37264241] {CVE-2024-50195}
- net: enetc: add missing static descriptor and inline keyword (Wei Fang)
- net: enetc: remove xdp_drops statistic from enetc_xdp_drop() (Wei Fang)
- udf: Fix bogus checksum computation in udf_rename() (Jan Kara) [Orabug: 37320204] {CVE-2024-43845}
- udf: Don't return bh from udf_expand_dir_adinicb() (Jan Kara)
- udf: Handle error when expanding directory (Jan Kara)
- udf: Remove old directory iteration code (Jan Kara)
- udf: Convert udf_link() to new directory iteration code (Jan Kara)
- udf: Convert udf_mkdir() to new directory iteration code (Jan Kara)
- udf: Convert udf_add_nondir() to new directory iteration (Jan Kara)
- udf: Implement adding of dir entries using new iteration code (Jan Kara)
- udf: Convert udf_unlink() to new directory iteration code (Jan Kara)
- udf: Convert udf_rmdir() to new directory iteration code (Jan Kara)
- udf: Convert empty_dir() to new directory iteration code (Jan Kara)
- udf: Convert udf_get_parent() to new directory iteration code (Jan Kara)
- udf: Convert udf_lookup() to use new directory iteration code (Jan Kara)
- udf: Convert udf_readdir() to new directory iteration (Jan Kara)
- udf: Convert udf_rename() to new directory iteration code (Jan Kara)
- udf: Provide function to mark entry as deleted using new directory iteration code (Jan Kara)
- udf: Implement searching for directory entry using new iteration code (Jan Kara)
- udf: Move udf_expand_dir_adinicb() to its callsite (Jan Kara)
- udf: Convert udf_expand_dir_adinicb() to new directory iteration (Jan Kara)
- udf: New directory iteration code (Jan Kara)
- ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 (Vasiliy Kovalev)</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2025-20277.html" type="self" title="ELBA-2025-20277" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="kernel-uek-doc" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="noarch">
          <filename>kernel-uek-doc-5.15.0-303.171.5.2.2.el9uek.noarch.rpm</filename>
          <sum type="sha256">12017418e407e1c60ebcfa315badb4dfccecb40d7ef0c96cdd752c78c628d411</sum>
        </package>
        <package name="kernel-uek-devel" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-devel-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">74f7806cbf1b68f3b600f5d7c98e0ae14451bb98a100ca1bca8b70e7e864d697</sum>
        </package>
        <package name="kernel-uek-debug-devel" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-devel-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">95a34e309616310a0aaa7d93c5769b2d4b6c51de9df2bde9cf49fcbde705010f</sum>
        </package>
        <package name="kernel-uek" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="src">
          <filename>kernel-uek-5.15.0-303.171.5.2.2.el9uek.src.rpm</filename>
          <sum type="sha256">0e7bdb2152dc0ac8bb80165b343180465c3141ee3c001e79a98d818d8c80f138</sum>
        </package>
        <package name="kernel-uek-debug-modules" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-modules-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">cab133e90514a9a55ade8d7b8027ae0a59d4c987e3c2c72dcdb9e10915157f37</sum>
        </package>
        <package name="kernel-uek-modules" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-modules-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">f043215405105466b67c794c0d0e7f9fd2f855a29bfb9e616f08ec99552fe50c</sum>
        </package>
        <package name="kernel-uek" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">61c5594b6a8445e1b67a05dbb5cccfe9c89616916d27ac96499430fba940ecb5</sum>
        </package>
        <package name="kernel-uek-modules-extra" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-modules-extra-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">53de5e911fb24ef7f98400f168ec7561434482bff96e468da2b7879967db3991</sum>
        </package>
        <package name="kernel-uek-debug-core" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-core-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">08c1f34df240edb54397640e533901f82aaf5bd2ac5e5d693f891fb051a244b2</sum>
        </package>
        <package name="kernel-uek-core" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-core-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">010583563258faa02c1a048cc6f74ba31c1b31e98c3f3f547621ae4004f001ed</sum>
        </package>
        <package name="kernel-uek-debug" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">f15194fc5feefb842c07dfd50086041e55a83c1d8caf71545042055b3739750c</sum>
        </package>
        <package name="kernel-uek-debug-modules-extra" version="5.15.0" release="303.171.5.2.2.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-modules-extra-5.15.0-303.171.5.2.2.el9uek.aarch64.rpm</filename>
          <sum type="sha256">eceb244bd5c65ba71c2590adb4f1add13e7395c1bd9ce5a8f36c886bebd47f73</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2025-20335</id>
    <title> gnutls  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2025-05-22 00:00:00"/>
    <updated date="2025-05-22 00:00:00"/>
    <rights>Copyright 2025 Oracle, Inc.</rights>
    <description>[3.8.3-6_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35925409]
- Update FIPS module name for Oracle Linux [Orabug: 35925409]

[3.8.3-6]
- Bump nettle dependency to 3.10.1 (RHEL-52740)

[3.8.3-5]
- Backport the fix for CVE-2024-12243 (RHEL-78580)</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2025-20335.html" type="self" title="ELBA-2025-20335" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="gnutls-dane" version="3.8.3" release="6.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-dane-3.8.3-6.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">7ff6494cc9228fbc63bd7c9772f6fa93a10bd6cb7600bf37a2112743397edfdf</sum>
        </package>
        <package name="gnutls-devel" version="3.8.3" release="6.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-devel-3.8.3-6.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">40326bbe9b803c3bdaef34c6f34c5849059eacf55b95f65a4c107f12a04cc626</sum>
        </package>
        <package name="gnutls-c++" version="3.8.3" release="6.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-c++-3.8.3-6.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">f240f52113dad1341664ab9cf0b7983f98598754a2661c569cf89071d090e5b0</sum>
        </package>
        <package name="gnutls" version="3.8.3" release="6.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-3.8.3-6.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">210053c9d0855589e690b0689399d4075e603b25f5f3d4b0e24b7272c76aa1a4</sum>
        </package>
        <package name="gnutls" version="3.8.3" release="6.el9_fips" epoch="10" arch="src">
          <filename>gnutls-3.8.3-6.el9_fips.src.rpm</filename>
          <sum type="sha256">d4f245396cc182d864fdf0db8d3988e6f8fac4c84533c7468e64b0d50985513f</sum>
        </package>
        <package name="gnutls-utils" version="3.8.3" release="6.el9_fips" epoch="10" arch="aarch64">
          <filename>gnutls-utils-3.8.3-6.el9_fips.aarch64.rpm</filename>
          <sum type="sha256">c3ab69ded8766101e7124dba2312ca2fc670498f343f4e11007612ced4997ffa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2024-12349</id>
    <title> nss  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2024-04-29 00:00:00"/>
    <updated date="2024-04-29 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[3.90.0-7_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35862190]
- Update FIPS module name for Oracle Linux [Orabug: 35862190]

[3.90.0-7]
- Allow for shorter ecdsa signatures by padding them to full length</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2024-12349.html" type="self" title="ELBA-2024-12349" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="nspr" version="4.35.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nspr-4.35.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">db330f20f297f52629c7320f0efd17e59f6a125874e3494983e8d1879402b69b</sum>
        </package>
        <package name="nss-util-devel" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-util-devel-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">d734965b4cb512a2a79bd37562cc68be6db9093a36f2baa5fb3055f49172b64f</sum>
        </package>
        <package name="nss-sysinit" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-sysinit-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">37fd3af920f0fecafd1fdb6caf57604892d7f9a3d684ac8b4b6626a6f31e50ff</sum>
        </package>
        <package name="nss-softokn-freebl" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">aa57df872859993d260a315d747b963b37ab5718e36d8be8290f72699e6370e6</sum>
        </package>
        <package name="nss-devel" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-devel-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">2915b5c9ce157bca5fab52adfabe4b5691f0c581bca3006e35b5ae63bbc2b9c5</sum>
        </package>
        <package name="nss" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="src">
          <filename>nss-3.90.0-7.el9_3_fips.src.rpm</filename>
          <sum type="sha256">e0af4511e82445a1aa4e3123a8060381b3998e3ded08fc51475420572cf8364d</sum>
        </package>
        <package name="nss-pkcs11-devel" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-pkcs11-devel-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">7336fd639fd89222892cc3111b29a35024997a7d0e6bae462a81f9d6181bf418</sum>
        </package>
        <package name="nspr-devel" version="4.35.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nspr-devel-4.35.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">589efb21b31981054e9c410ba58f44ef3dff063281a4c214af5cb51e00d84831</sum>
        </package>
        <package name="nss-tools" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-tools-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">dbdc4fc2d11de069fcfb54ba279e447d3b31856ba5d74d79f42abd58b192c7d8</sum>
        </package>
        <package name="nss-softokn-devel" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-devel-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">7d66bd606288dac26fbca950d5ffee0bd03dc6ad7d00a176dde0fef70d2792dc</sum>
        </package>
        <package name="nss" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">d49245ac49616d5c0f05f6abea5189450d7499b7a712487ebd344d71d11cd00a</sum>
        </package>
        <package name="nss-softokn" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">e574d110948edf1546629fa4e939aef5d758f6d5d717ac2efaacf1208cfef57c</sum>
        </package>
        <package name="nss-softokn-freebl-devel" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-devel-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">c0cd985d86c10a1c1b21e8fc426a6c83afdde0c2dd1818423e846a6e0d21ca61</sum>
        </package>
        <package name="nss-util" version="3.90.0" release="7.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-util-3.90.0-7.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">00429db58cb206bbb261ab84428dfded35bfd06a283f051253d619783d449f05</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2026-50075</id>
    <title>openssl security update</title>
    <severity>Important</severity>
    <release>Oracle Linux 9</release>
    <issued date="2026-01-29 00:00:00"/>
    <updated date="2026-01-29 00:00:00"/>
    <rights>Copyright 2026 Oracle, Inc.</rights>
    <description>[3.5.1-7.0.1_fips]
- Update additional upstream references
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name [Orabug: 35824276]

[3.5.1-7.0.1]
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]

[3.5.1.openela.0.1]
- Add OpenELA specific changes

[1:3.5.1-7]
- Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469
  CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420
  CVE-2025-69421 CVE-2026-22795 CVE-2026-22796
  Resolves: RHEL-142068
  Resolves: RHEL-142002
  Resolves: RHEL-142055
  Resolves: RHEL-142051
  Resolves: RHEL-142047
  Resolves: RHEL-142043
  Resolves: RHEL-142039
  Resolves: RHEL-142035
  Resolves: RHEL-142031
  Resolves: RHEL-142011
  Resolves: RHEL-142027
  Resolves: RHEL-142023

[1:3.5.1-6]
- Fix AES/GCM ppc64le encrypt/decrypt
  Resolves: RHEL-139131</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2026-50075.html" type="self" title="ELSA-2026-50075" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-11187.html" id="CVE-2025-11187" type="cve" title="CVE-2025-11187" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-15467.html" id="CVE-2025-15467" type="cve" title="CVE-2025-15467" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-15468.html" id="CVE-2025-15468" type="cve" title="CVE-2025-15468" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-15469.html" id="CVE-2025-15469" type="cve" title="CVE-2025-15469" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-66199.html" id="CVE-2025-66199" type="cve" title="CVE-2025-66199" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-68160.html" id="CVE-2025-68160" type="cve" title="CVE-2025-68160" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-69418.html" id="CVE-2025-69418" type="cve" title="CVE-2025-69418" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-69419.html" id="CVE-2025-69419" type="cve" title="CVE-2025-69419" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-69420.html" id="CVE-2025-69420" type="cve" title="CVE-2025-69420" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-69421.html" id="CVE-2025-69421" type="cve" title="CVE-2025-69421" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-22795.html" id="CVE-2026-22795" type="cve" title="CVE-2026-22795" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-22796.html" id="CVE-2026-22796" type="cve" title="CVE-2026-22796" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="openssl-libs" version="3.5.1" release="7.0.1.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-libs-3.5.1-7.0.1.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">7d211c226a40473247b0e576f017fee999ee9793adc28cd8f0111703de9843c2</sum>
        </package>
        <package name="openssl" version="3.5.1" release="7.0.1.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-3.5.1-7.0.1.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">3a47ced7e14660b48cd56a74d595d31d687d96fc5da92cb64be6188cb34d33ab</sum>
        </package>
        <package name="openssl-devel" version="3.5.1" release="7.0.1.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-devel-3.5.1-7.0.1.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">cfd7fcbae0fe24ce314368f5c6c654e979422b23962118cd36f61938c449a923</sum>
        </package>
        <package name="openssl-perl" version="3.5.1" release="7.0.1.el9_7_fips" epoch="10" arch="aarch64">
          <filename>openssl-perl-3.5.1-7.0.1.el9_7_fips.aarch64.rpm</filename>
          <sum type="sha256">50ac7bb8043378262ef98c1aaa833e6ca3bb2743a41eebb2f6488217ff9bef1d</sum>
        </package>
        <package name="openssl" version="3.5.1" release="7.0.1.el9_7_fips" epoch="10" arch="src">
          <filename>openssl-3.5.1-7.0.1.el9_7_fips.src.rpm</filename>
          <sum type="sha256">5d7698cada1e2b97941a604431dd86a722791e4fff3266ffbe9e041b70300ceb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2024-12337</id>
    <title>nss security update</title>
    <severity>Moderate</severity>
    <release>Oracle Linux 9</release>
    <issued date="2024-04-19 00:00:00"/>
    <updated date="2024-04-19 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[3.90.0-6_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35862190]
- Update FIPS module name for Oracle Linux [Orabug: 35862190]

[3.90.0-6]
- Fix ecc DER wrapping.

[3.90.0-5]
- Pick up validated constant time implementations of p256, p384, and p521
  from upsream
- More Fips indicator changes

[3.90.0-4]
- FIPS review changes
-   add PORT_SafeZero to avoid compiler optimizing a way zeroing memory.
-   update the indicators for this release
-   allow hashing of longer than int32 values in a single PKCS #11 call.

[3.90.0-3.3]
- Fix expired certs in tests
- Fix CVE-2023-5388</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2024-12337.html" type="self" title="ELSA-2024-12337" />
      <reference href="https://linux.oracle.com/cve/CVE-2023-6135.html" id="CVE-2023-6135" type="cve" title="CVE-2023-6135" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="nss-devel" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-devel-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">cd8e8d0623b3b182ea9bf59ed5c446bee7a9ab1478a0d9f25bea5fced4aa229c</sum>
        </package>
        <package name="nss-softokn" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">67f3506044931ef68164997367fc1a21400c32a32532c2ffd0d8f7d0c7e785b8</sum>
        </package>
        <package name="nss" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">d3a4a901c9bd2beae01c91ac969607ade91a3c62a5449e94b333f9111a42f59a</sum>
        </package>
        <package name="nss-util-devel" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-util-devel-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">a3305a132509d002410dd910e346a1e75e82cf46425fc2b666f9fc690e545a38</sum>
        </package>
        <package name="nspr" version="4.35.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nspr-4.35.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">d0086177f302c1a1ab6e3979c79f7c47c2859d0d8d9b5ad6dc6252bd3d5091fb</sum>
        </package>
        <package name="nss-softokn-freebl-devel" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-devel-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">3e36710b7d9d6a987e6d8243530f908bad011ca1b320937979c0d043b0c5deb1</sum>
        </package>
        <package name="nss-softokn-freebl" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-freebl-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">244255aa8378d4f4e968b1a56b45e56af380f835a28252146c3d048cc70ca12b</sum>
        </package>
        <package name="nss" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="src">
          <filename>nss-3.90.0-6.el9_3_fips.src.rpm</filename>
          <sum type="sha256">8051764ad1d7e0563e7920d6529a1b95f894b2bd178f67e90ab7e81bec56f931</sum>
        </package>
        <package name="nss-pkcs11-devel" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-pkcs11-devel-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">166784fa3082183a9a7d9e28aba4e4fb7fcc8117caff17253968abbcd4cf0128</sum>
        </package>
        <package name="nss-util" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-util-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">d9ac6678d069cff60910bcc19ff6f5867638f97c6db8d1bd4046be06d7427169</sum>
        </package>
        <package name="nspr-devel" version="4.35.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nspr-devel-4.35.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">cfc691c9decdbb52f64bf3c3f31bf2761750987b588ace477789cd0e730c5b08</sum>
        </package>
        <package name="nss-sysinit" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-sysinit-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">49b713844617c1b4f0ca3423413451c096f17a1064a4574ada0a0850cb9e5bec</sum>
        </package>
        <package name="nss-softokn-devel" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-softokn-devel-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">6bf3390fd4477749ccc2d33297c23d7dd3464387f185c3141931ccdd095e2ec9</sum>
        </package>
        <package name="nss-tools" version="3.90.0" release="6.el9_3_fips" epoch="10" arch="aarch64">
          <filename>nss-tools-3.90.0-6.el9_3_fips.aarch64.rpm</filename>
          <sum type="sha256">7e5b5f51e6e1bcd785172993168e0c13119940416860e195eddc1ab9808e6d8c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2022-6854</id>
    <title> gnutls and nettle security, bug fix, and enhancement update</title>
    <severity>Moderate</severity>
    <release>Oracle Linux 9</release>
    <issued date="2022-10-11 00:00:00"/>
    <updated date="2022-10-11 00:00:00"/>
    <rights>Copyright 2022 Oracle, Inc.</rights>
    <description>gnutls
[3.7.6-12]
- fips: mark PBKDF2 with short key and output sizes non-approved
- fips: only mark HMAC as approved in PBKDF2
- fips: mark gnutls_key_generate with short key sizes non-approved
- fips: fix checking on hash algorithm used in ECDSA
- fips: preserve operation context around FIPS selftests API

[3.7.6-11]
- Supply --with{,out}-{zlib,brotli,zstd} explicitly

[3.7.6-10]
- Revert nettle version pinning as it doesn't work well in side-tag

[3.7.6-9]
- Pin nettle version in Requires when compiled with FIPS

[3.7.6-8]
- Bundle GMP to privatize memory functions
- Disable certificate compression support by default

[3.7.6-7]
- Update gnutls-3.7.6-cpuid-fixes.patch

[3.7.6-6]
- Mark RSA SigVer operation approved for known modulus sizes (#2119770)
- accelerated: clear AVX bits if it cannot be queried through XSAVE

[3.7.6-5]
- Block DES-CBC usage in decrypting PKCS#12 bag under FIPS (#2115314)
- sysrng: reseed source DRBG for prediction resistance

[3.7.6-4]
- Make gnutls-cli work with KTLS for testing
- Fix double-free in gnutls_pkcs7_verify (#2109789)

[3.7.6-3]
- Limit input size for AES-GCM according to SP800-38D (#2108635)
- Do not treat GPG verification errors as fatal
- Remove gnutls-3.7.6-libgnutlsxx-const.patch

[3.7.6-2]
- Allow enabling KTLS with config file (#2108532)

[3.7.6-1]
- Update to gnutls 3.7.6 (#2102591)

[3.7.3-10]
- Use only the first component of VERSION from /etc/os-release (#2076626)
- Don't run power-on self-tests on DSA (#2076627)

nettle
[3.8-3]
- Rebuild in new side-tag

[3.8-2]
- Bundle GMP to privatize memory functions
- Zeroize stack allocated intermediate data

[3.8-1]
- Update to nettle 3.8 (#2100350)</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2022-6854.html" type="self" title="ELSA-2022-6854" />
      <reference href="https://linux.oracle.com/cve/CVE-2022-2509.html" id="CVE-2022-2509" type="cve" title="CVE-2022-2509" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="nettle" version="3.8" release="3.el9_0" epoch="0" arch="aarch64">
          <filename>nettle-3.8-3.el9_0.aarch64.rpm</filename>
          <sum type="sha256">9569a694b43f7e56a25100b03e0f52fdc11967b8f1137ad49fd589498b8a3004</sum>
        </package>
        <package name="nettle-devel" version="3.8" release="3.el9_0" epoch="0" arch="aarch64">
          <filename>nettle-devel-3.8-3.el9_0.aarch64.rpm</filename>
          <sum type="sha256">9540b8ab32ca4181dffe2445f4c018b8d5a8e9829b5caeba2ce6ba5207587cd2</sum>
        </package>
        <package name="nettle" version="3.8" release="3.el9_0" epoch="0" arch="src">
          <filename>nettle-3.8-3.el9_0.src.rpm</filename>
          <sum type="sha256">8f67ea51932ba3195402cdac06b8a30437e5234b834c6ae4095c3d6e469e002f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2022-4164</id>
    <title> libkcapi</title>
    <release>Oracle Linux 9</release>
    <issued date="2022-06-30 00:00:00"/>
    <updated date="2022-06-30 00:00:00"/>
    <rights>Copyright 2022 Oracle, Inc.</rights>
    <description>[1.3.1-3.0.1]
- Change distroname_ext in spec file to oracle

[1.3.1-3]
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
  Related: rhbz#1991688

[1.3.1-2]
- Bring back usage of /usr/lib64 instead of /lib64
- Resolves: rhbz#1982620

[1.3.1-1]
- Update to new upstream release 1.3.1
- This fixes ABI issues and incorporates previous patches

[1.3.0-1]
- Update to new upstream release 1.3.0

[1.2.1-3]
- Rebuilt for RHEL 9 BETA for openssl 3.0
  Related: rhbz#1971065

[1.2.1-2]
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

[1.2.1-1]
- Update to upstream version 1.2.1
- Remove patch fix MSG_MORE uasge as it is added upstream
- Remove cppcheck dependency for rhel bz#1931518
- Add a patch to fix fuzz tests

[1.2.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

[1.2.0-3]
- Require perl-interpreter instead of full perl
- Backport fix for 5.9 kernels

[1.2.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

[1.2.0-1]
- Update to upstream version 1.2.0 tracked by BZ 1839592.
- Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed.
- Remove 110-fipshmac-compat.patch as the changes are merged upstream.
- Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream.

[1.1.5-5]
- Fix the CI test failures
- Enable building on old kernels
- Avoid conflicts between different versions of packages

[1.1.5-4]
- Add . prefix to files created by fipshmac if -d option is not specified

[1.1.5-3]
- Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed.
- Produce also the fipscheck replacement package

[1.1.5-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2022-4164.html" type="self" title="ELBA-2022-4164" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="libkcapi-hmaccalc" version="1.3.1" release="3.0.1.el9" epoch="0" arch="aarch64">
          <filename>libkcapi-hmaccalc-1.3.1-3.0.1.el9.aarch64.rpm</filename>
          <sum type="sha256">2341956d4f3e9dc974dad7194f2a6c87317bcdea1dfec72f46ade4dbdad33419</sum>
        </package>
        <package name="libkcapi" version="1.3.1" release="3.0.1.el9" epoch="0" arch="src">
          <filename>libkcapi-1.3.1-3.0.1.el9.src.rpm</filename>
          <sum type="sha256">6d73063faf0e639195aa39aa6c3b9f62f9401c8dccfaae7851ead33115a22048</sum>
        </package>
        <package name="libkcapi" version="1.3.1" release="3.0.1.el9" epoch="0" arch="aarch64">
          <filename>libkcapi-1.3.1-3.0.1.el9.aarch64.rpm</filename>
          <sum type="sha256">37679f15a28b7ea9f52f7f0fd5391ffdfd930bf2f21506500cfec9325b622abc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="bugfix" version="1" from="el-errata@oss.oracle.com">
    <id>ELBA-2025-20102</id>
    <title> openssl  bug fix update</title>
    <release>Oracle Linux 9</release>
    <issued date="2025-02-12 00:00:00"/>
    <updated date="2025-02-12 00:00:00"/>
    <rights>Copyright 2025 Oracle, Inc.</rights>
    <description>[1:3.2.2-6.0.1.1_fips]
- Replace upstream references in fips man pages [Orabug: 35824276]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name and remove upstream references from
  fips_module_indicators manpage [Orabug: 35824276]

[3.2.2-6.0.1.1]
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELBA-2025-20102.html" type="self" title="ELBA-2025-20102" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="openssl-devel" version="3.2.2" release="6.0.1.el9_5.1_fips" epoch="10" arch="aarch64">
          <filename>openssl-devel-3.2.2-6.0.1.el9_5.1_fips.aarch64.rpm</filename>
          <sum type="sha256">d10c05816b1839bcabc7711e63dfdab724d790cb441399f08a7756d8f1b34e9d</sum>
        </package>
        <package name="openssl" version="3.2.2" release="6.0.1.el9_5.1_fips" epoch="10" arch="src">
          <filename>openssl-3.2.2-6.0.1.el9_5.1_fips.src.rpm</filename>
          <sum type="sha256">58089612061d7ef1dc7a8ab29ad0da470f1e29ed16f2658d95d16a86a7285f05</sum>
        </package>
        <package name="openssl-perl" version="3.2.2" release="6.0.1.el9_5.1_fips" epoch="10" arch="aarch64">
          <filename>openssl-perl-3.2.2-6.0.1.el9_5.1_fips.aarch64.rpm</filename>
          <sum type="sha256">ee6323886de7e9df09de917182d72ab2a70fd544fcd146a8028afca945affbf3</sum>
        </package>
        <package name="openssl-libs" version="3.2.2" release="6.0.1.el9_5.1_fips" epoch="10" arch="aarch64">
          <filename>openssl-libs-3.2.2-6.0.1.el9_5.1_fips.aarch64.rpm</filename>
          <sum type="sha256">545209f1a428e4775b64a88a2b6a3f8c84fd61ad16908f0e00ea55e4c76ba6fa</sum>
        </package>
        <package name="openssl" version="3.2.2" release="6.0.1.el9_5.1_fips" epoch="10" arch="aarch64">
          <filename>openssl-3.2.2-6.0.1.el9_5.1_fips.aarch64.rpm</filename>
          <sum type="sha256">1c91976757facb8055404a792c3bfd98df6062a8fa4bebd513ae3e9a1bbf4eeb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2024-12336</id>
    <title>gnutls security update</title>
    <severity>Moderate</severity>
    <release>Oracle Linux 9</release>
    <issued date="2024-04-19 00:00:00"/>
    <updated date="2024-04-19 00:00:00"/>
    <rights>Copyright 2024 Oracle, Inc.</rights>
    <description>[3.7.6-23.4_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35925409]
- Update FIPS module name for Oracle Linux [Orabug: 35925409]
- Verify salt length and iteration count for PBKDF [Orabug: 35925409]

[3.7.6-23.4]
- Fix timing side-channel in deterministic ECDSA (RHEL-28958)
- Fix potential crash during chain building/verification (RHEL-28953)

[3.7.6-23.3]
- x509: detect loop in certificate chain (RHEL-21759)
- fips: Zeroize temporary values in integrity check (RHEL-21870)

[3.7.6-23.2]
- auth/rsa_psk: minimize branching after decryption

[3.7.6-23.1]
- auth/rsa_psk: side-step potential side-channel (RHEL-16755)

[3.7.6-23]
- Mark SHA-1 signature verification non-approved in FIPS (#2102751)

[3.7.6-22]
- Skip KTLS test on old kernel if host and target arches are different</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2024-12336.html" type="self" title="ELSA-2024-12336" />
      <reference href="https://linux.oracle.com/cve/CVE-2023-5981.html" id="CVE-2023-5981" type="cve" title="CVE-2023-5981" />
      <reference href="https://linux.oracle.com/cve/CVE-2024-0553.html" id="CVE-2024-0553" type="cve" title="CVE-2024-0553" />
      <reference href="https://linux.oracle.com/cve/CVE-2024-0567.html" id="CVE-2024-0567" type="cve" title="CVE-2024-0567" />
      <reference href="https://linux.oracle.com/cve/CVE-2024-28834.html" id="CVE-2024-28834" type="cve" title="CVE-2024-28834" />
      <reference href="https://linux.oracle.com/cve/CVE-2024-28835.html" id="CVE-2024-28835" type="cve" title="CVE-2024-28835" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="gnutls-c++" version="3.7.6" release="23.el9_3.4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-c++-3.7.6-23.el9_3.4_fips.aarch64.rpm</filename>
          <sum type="sha256">b9c308927ff93f25e7802af10c71ae0e41e1023924820904ee82862bb4226e58</sum>
        </package>
        <package name="gnutls-dane" version="3.7.6" release="23.el9_3.4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-dane-3.7.6-23.el9_3.4_fips.aarch64.rpm</filename>
          <sum type="sha256">8f3e13498bd7b3d9c23898b72d0f30f6d5611db2ae1f2676db9b11f4ae74b01a</sum>
        </package>
        <package name="gnutls-devel" version="3.7.6" release="23.el9_3.4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-devel-3.7.6-23.el9_3.4_fips.aarch64.rpm</filename>
          <sum type="sha256">e929dea656909c2c1f1eb6a3e121ac4af5823eb157468403ffcb295ec0f96016</sum>
        </package>
        <package name="gnutls-utils" version="3.7.6" release="23.el9_3.4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-utils-3.7.6-23.el9_3.4_fips.aarch64.rpm</filename>
          <sum type="sha256">f2ee871dbfe6968eaf3070053d6dd774f663964cb61c58508f5f63fbf8e924a5</sum>
        </package>
        <package name="gnutls" version="3.7.6" release="23.el9_3.4_fips" epoch="10" arch="aarch64">
          <filename>gnutls-3.7.6-23.el9_3.4_fips.aarch64.rpm</filename>
          <sum type="sha256">04c0889ecef167548318d6251d6058a953eca5fc313584a41e82b5e9545347e3</sum>
        </package>
        <package name="gnutls" version="3.7.6" release="23.el9_3.4_fips" epoch="10" arch="src">
          <filename>gnutls-3.7.6-23.el9_3.4_fips.src.rpm</filename>
          <sum type="sha256">90ac854dc89000dc434aa931ef6e7b6399e94f70265e9b3d4b01652d9171ce58</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2025-20606</id>
    <title>gnutls security update</title>
    <severity>Moderate</severity>
    <release>Oracle Linux 9</release>
    <issued date="2025-09-19 00:00:00"/>
    <updated date="2025-09-19 00:00:00"/>
    <rights>Copyright 2025 Oracle, Inc.</rights>
    <description>[3.8.3-6.2_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35925409]
- Update FIPS module name for Oracle Linux [Orabug: 35925409]

[3.8.3-6.2]
- key_update: rework the rekeying logic (RHEL-107498)

[3.8.3-6.1]
- Fix CVE-2025-32988, CVE-2025-32989, CVE-2025-32990, and CVE-2025-6395</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2025-20606.html" type="self" title="ELSA-2025-20606" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-32988.html" id="CVE-2025-32988" type="cve" title="CVE-2025-32988" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-32989.html" id="CVE-2025-32989" type="cve" title="CVE-2025-32989" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-32990.html" id="CVE-2025-32990" type="cve" title="CVE-2025-32990" />
      <reference href="https://linux.oracle.com/cve/CVE-2025-6395.html" id="CVE-2025-6395" type="cve" title="CVE-2025-6395" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="gnutls" version="3.8.3" release="6.el9_6.2_fips" epoch="10" arch="aarch64">
          <filename>gnutls-3.8.3-6.el9_6.2_fips.aarch64.rpm</filename>
          <sum type="sha256">f44a09630bacd7f34d09a60d6b075f1b3eea4d12fd4d08c3e4e7fd4e670138db</sum>
        </package>
        <package name="gnutls-devel" version="3.8.3" release="6.el9_6.2_fips" epoch="10" arch="aarch64">
          <filename>gnutls-devel-3.8.3-6.el9_6.2_fips.aarch64.rpm</filename>
          <sum type="sha256">f3d09611229b786078d21e7ee11bd682e80b2d8d6a4759d6c17f468f49c02f00</sum>
        </package>
        <package name="gnutls" version="3.8.3" release="6.el9_6.2_fips" epoch="10" arch="src">
          <filename>gnutls-3.8.3-6.el9_6.2_fips.src.rpm</filename>
          <sum type="sha256">204c86db96267a432f3ef4cac9bd868309dd4ee91f8f14cc95c723c3424d0e8f</sum>
        </package>
        <package name="gnutls-utils" version="3.8.3" release="6.el9_6.2_fips" epoch="10" arch="aarch64">
          <filename>gnutls-utils-3.8.3-6.el9_6.2_fips.aarch64.rpm</filename>
          <sum type="sha256">8e61a840a5bb52aa8685f789dba030f1ef2e24fcbdee7d6b01ddc68b02052e49</sum>
        </package>
        <package name="gnutls-c++" version="3.8.3" release="6.el9_6.2_fips" epoch="10" arch="aarch64">
          <filename>gnutls-c++-3.8.3-6.el9_6.2_fips.aarch64.rpm</filename>
          <sum type="sha256">25871ef1c19f1a2669fed183c6b6a2a690f06959e9dfe61ddf2e6e97d13320f4</sum>
        </package>
        <package name="gnutls-dane" version="3.8.3" release="6.el9_6.2_fips" epoch="10" arch="aarch64">
          <filename>gnutls-dane-3.8.3-6.el9_6.2_fips.aarch64.rpm</filename>
          <sum type="sha256">0fac496e0559b60e7490797242732d16451ac6ec9f5e190b5c7ffd3458170a5b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2023-12339</id>
    <title> Unbreakable Enterprise kernel security update</title>
    <severity>Important</severity>
    <release>Oracle Linux 9</release>
    <issued date="2023-05-09 00:00:00"/>
    <updated date="2023-05-09 00:00:00"/>
    <rights>Copyright 2023 Oracle, Inc.</rights>
    <description>[5.15.0-101.103.2.1]
- Revert 'attr: use consistent sgid stripping checks' (Sherry Yang)  [Orabug: 35346968] 
- Revert 'iommu: Force iommu shutdown on panic' (Boris Ostrovsky)  [Orabug: 35346963]

[5.15.0-101.103.2]
- uek-rpm: mod-extra: Remove mt7921e.ko from extras list (Harshit Mogalapalli)  [Orabug: 34999685] 
- crypto: allow ECDH and ECDSA algorithms in FIPS (Saeed Mirzamohammadi)  [Orabug: 35230211] 
- uek-rpm: make CRYPTO_ECDSA builtin (Saeed Mirzamohammadi)  [Orabug: 35230211] 
- KVM: arm64: PMU: Align chained counter implementation with architecture pseudocode (Marc Zyngier)  [Orabug: 35243389] 
- net/mlx5: Fix memory leak in error flow of port set buffer (Maher Sanalla)  [Orabug: 35246355] 
- net/mlx5e: Update shared buffer along with device buffer changes (Maher Sanalla)  [Orabug: 35246355] 
- net/mlx5e: Add API to query/modify SBPR and SBCM registers (Maher Sanalla)  [Orabug: 35246355] 
- net/mlx5: Expose shared buffer registers bits and structs (Maher Sanalla)  [Orabug: 35246355] 
- PCI: Work around Intel I210 ROM BAR overlap defect (Bjorn Helgaas)  [Orabug: 35250975] 
- net/rds: Adding TCP stats for TCP keepalive timeout (Nagappan Ramasamy Palaniappan)  [Orabug: 35254377] 
- rds: slight code cleanup of RDS checksum code (William Kucharski)  [Orabug: 35262486] 
- x86/acpi/boot: Correct acpi_is_processor_usable() check (Eric DeVolder)  [Orabug: 35274587] 
- x86/ACPI/boot: Use FADT version to check support for online capable (Mario Limonciello)  [Orabug: 35274587] 
- x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC (Kishon Vijay Abraham I)  [Orabug: 35274587] 
- x86/ACPI: Don't add CPUs that are not online capable (Mario Limonciello)  [Orabug: 35274587] 
- ACPICA: Add support for MADT online enabled bit (Mario Limonciello)  [Orabug: 35274587] 
- net/rds: use appropriate reason while dropping a connection (Praveen Kumar Kannoju)  [Orabug: 35278121] 
- KVM: nVMX: add missing consistency checks for CR0 and CR4 (Paolo Bonzini)  [Orabug: 35278210]  {CVE-2023-30456}
- Revert 'scsi: megaraid_sas: Skip syncing the RAID map on older controllers' (Sherry Yang)  [Orabug: 35285941]

[5.15.0-101.103.1]
- Revert 'Revert 'x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments'' (Tom Saeger)  
- Revert 'Revert 'Makefile: link with -z noexecstack --no-warn-rwx-segments'' (Tom Saeger)  
- LTS version: v5.15.103 (Jack Vogel)  
- Makefile: use -gdwarf-{4|5} for assembler for DEBUG_INFO_DWARF{4|5} (Nick Desaulniers)  
- KVM: VMX: Fix crash due to uninitialized current_vmcs (Alexandru Matei)  
- KVM: VMX: Introduce vmx_msr_bitmap_l01_changed() helper (Vitaly Kuznetsov)  
- KVM: nVMX: Don't use Enlightened MSR Bitmap for L3 (Vitaly Kuznetsov)  
- fs: hold writers when changing mount's idmapping (Christian Brauner)  
- UML: define RUNTIME_DISCARD_EXIT (Masahiro Yamada)  
- xfs: remove xfs_setattr_time() declaration (Gaosheng Cui)  
- KVM: fix memoryleak in kvm_init() (Miaohe Lin)  
- tools bpftool: Fix compilation error with new binutils (Andres Freund)  
- tools bpf_jit_disasm: Fix compilation error with new binutils (Andres Freund)  
- tools perf: Fix compilation error with new binutils (Andres Freund)  
- tools include: add dis-asm-compat.h to handle version differences (Andres Freund)  
- tools build: Add feature test for init_disassemble_info API changes (Andres Freund)  
- sh: define RUNTIME_DISCARD_EXIT (Tom Saeger)  
- s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld &lt; 2.36 (Masahiro Yamada)  
- powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds (Michael Ellerman)  
- powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT (Michael Ellerman)  
- arch: fix broken BuildID for arm64 and riscv (Masahiro Yamada)  
- ext4: block range must be validated before use in ext4_mb_clear_bb() (Lukas Czerner)  
- ext4: add strict range checks while freeing blocks (Ritesh Harjani)  
- ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid() (Ritesh Harjani)  
- ext4: refactor ext4_free_blocks() to pull out ext4_mb_clear_bb() (Ritesh Harjani)  
- filelocks: use mount idmapping for setlease permission check (Seth Forshee)  
- media: rc: gpio-ir-recv: add remove function (Li Jun)  
- media: ov5640: Fix analogue gain control (Paul Elder)  
- scripts: handle BrokenPipeError for python scripts (Masahiro Yamada)  
- PCI: Add SolidRun vendor ID (Alvaro Karsz)  
- macintosh: windfarm: Use unsigned type for 1-bit bitfields (Nathan Chancellor)  
- alpha: fix R_ALPHA_LITERAL reloc for large modules (Edward Humes)  
- powerpc/kcsan: Exclude udelay to prevent recursive instrumentation (Rohan McLure)  
- powerpc/iommu: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- MIPS: Fix a compilation issue (xurui)  
- fs: use consistent setgid checks in is_sxid() (Christian Brauner)  
- attr: use consistent sgid stripping checks (Christian Brauner)  
- attr: add setattr_should_drop_sgid() (Christian Brauner)  
- fs: move should_remove_suid() (Christian Brauner)  
- attr: add in_group_or_capable() (Christian Brauner)  
- fs: move S_ISGID stripping into the vfs_*() helpers (Yang Xu)  
- fs: add mode_strip_sgid() helper (Yang Xu)  
- xfs: set prealloc flag in xfs_alloc_file_space() (Dave Chinner)  
- xfs: fallocate() should call file_modified() (Dave Chinner)  
- xfs: remove XFS_PREALLOC_SYNC (Dave Chinner)  
- xfs: use setattr_copy to set vfs inode attributes (Darrick J. Wong)  
- tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address (Morten Linderud)  
- watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths (David Disseldorp)  
- staging: rtl8723bs: Fix key-store index handling (Hans de Goede)  
- staging: rtl8723bs: fix placement of braces (Hannes Braun)  
- Staging: rtl8723bs: Placing opening { braces in previous line (Jagath Jog J)  
- staging: rtl8723bs: clean up comparsions to NULL (Michael Straube)  
- iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (Gavrilov Ilia)  
- iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options (Kim Phillips)  
- iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands (Suravee Suthikulpanit)  
- nbd: use the correct block_device in nbd_bdev_reset (Christoph Hellwig)  
- irqdomain: Fix mapping-creation race (Johan Hovold)  
- ext4: Fix deadlock during directory rename (Jan Kara)  
- RISC-V: Don't check text_mutex during stop_machine (Conor Dooley)  
- s390/ftrace: remove dead code (Heiko Carstens)  
- riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode (Alexandre Ghiti)  
- af_unix: fix struct pid leaks in OOB support (Eric Dumazet)  
- af_unix: Remove unnecessary brackets around CONFIG_AF_UNIX_OOB. (Kuniyuki Iwashima)  
- net: dsa: mt7530: permit port 5 to work without port 6 on MT7621 SoC (Vladimir Oltean)  
- SUNRPC: Fix a server shutdown leak (Benjamin Coddington)  
- octeontx2-af: Unlock contexts in the queue context cache in case of fault detection (Suman Ghosh)  
- net/smc: fix fallback failed while sendmsg with fastopen (D. Wythe)  
- platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it (Randy Dunlap)  
- netfilter: conntrack: adopt safer max chain length (Eric Dumazet)  
- scsi: megaraid_sas: Update max supported LD IDs to 240 (Chandrakanth Patil)  
- net: ethernet: mtk_eth_soc: fix RX data corruption issue (Daniel Golle)  
- net: phy: smsc: fix link up detection in forced irq mode (Heiner Kallweit)  
- net: phy: smsc: Cache interrupt mask (Lukas Wunner)  
- btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR (Lorenz Bauer)  
- netfilter: tproxy: fix deadlock due to missing BH disable (Florian Westphal)  
- netfilter: ctnetlink: revert to dumping mark regardless of event type (Ivan Delalande)  
- bnxt_en: Avoid order-5 memory allocation for TPA data (Michael Chan)  
- net: phylib: get rid of unnecessary locking (Russell King (Oracle))  
- net: stmmac: add to set device wake up flag when stmmac init phy (Rongguang Wei)  
- drm/msm/dpu: fix len of sc7180 ctl blocks (Dmitry Baryshkov)  
- bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() (Liu Jian)  
- ice: copy last block omitted in ice_get_module_eeprom() (Petr Oros)  
- net: caif: Fix use-after-free in cfusbl_device_notify() (Shigeru Yoshida)  
- net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver (Yuiko Oshino)  
- perf stat: Fix counting when initial delay configured (Changbin Du)  
- selftests: nft_nat: ensuring the listening side is up before starting the client (Hangbin Liu)  
- ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (Eric Dumazet)  
- powerpc: dts: t1040rdb: fix compatible string for Rev A boards (Vladimir Oltean)  
- nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties (Kang Chen)  
- bgmac: fix *initial* chip reset to support BCM5358 (Rafal Milecki)  
- drm/msm/a5xx: fix context faults during ring switch (Dmitry Baryshkov)  
- drm/msm/a5xx: fix the emptyness check in the preempt code (Dmitry Baryshkov)  
- drm/msm/a5xx: fix highest bank bit for a530 (Dmitry Baryshkov)  
- drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register (Dmitry Baryshkov)  
- drm/msm: Fix potential invalid ptr free (Rob Clark)  
- drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype (Jiri Slaby (SUSE))  
- drm/nouveau/kms/nv50-: remove unused functions (Ben Skeggs)  
- ext4: Fix possible corruption when moving a directory (Jan Kara)  
- regulator: core: Use ktime_get_boottime() to determine how long a regulator was off (Matthias Kaehlcke)  
- regulator: core: Fix off-on-delay-us for always-on/boot-on regulators (Christian Kohlschutter)  
- regulator: Flag uncontrollable regulators as always_on (Mark Brown)  
- scsi: core: Remove the /proc/scsi/ directory earlier (Bart Van Assche)  
- riscv: Add header include guards to insn.h (Liao Chang)  
- riscv: Avoid enabling interrupts in die() (Mattias Nissler)  
- RISC-V: Avoid dereferening NULL regs in die() (Palmer Dabbelt)  
- arm64: efi: Make efi_rt_lock a raw_spinlock (Pierre Gondois)  
- brd: mark as nowait compatible (Jens Axboe)  
- block/brd: add error handling support for add_disk() (Luis Chamberlain)  
- iommu/vt-d: Fix PASID directory pointer coherency (Jacob Pan)  
- irqdomain: Refactor __irq_domain_alloc_irqs() (Johan Hovold)  
- f2fs: retry to update the inode page given data corruption (Jaegeuk Kim)  
- f2fs: do not bother checkpoint by f2fs_get_node_info (Jaegeuk Kim)  
- f2fs: avoid down_write on nat_tree_lock during checkpoint (Jaegeuk Kim)  
- udf: Fix off-by-one error when discarding preallocation (Jan Kara)  
- fs: dlm: start midcomms before scand (Alexander Aring)  
- fs: dlm: add midcomms init/start functions (Alexander Aring)  
- fs: dlm: fix log of lowcomms vs midcomms (Alexander Aring)  
- KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target (Sean Christopherson)  
- KVM: SVM: Don't rewrite guest ICR on AVIC IPI virtualization failure (Sean Christopherson)  
- KVM: Register /dev/kvm as the _very_ last thing during initialization (Sean Christopherson)  
- KVM: Pre-allocate cpumasks for kvm_make_all_cpus_request_except() (Vitaly Kuznetsov)  
- KVM: Optimize kvm_make_vcpus_request_mask() a bit (Vitaly Kuznetsov)  
- nfc: change order inside nfc_se_io error path (Fedor Pchelkin)  
- ext4: zero i_disksize when initializing the bootloader inode (Zhihao Cheng)  
- ext4: fix WARNING in ext4_update_inline_data (Ye Bin)  
- ext4: move where set the MAY_INLINE_DATA flag is set (Ye Bin)  
- ext4: fix another off-by-one fsmap error on 1k block filesystems (Darrick J. Wong)  
- ext4: fix RENAME_WHITEOUT handling for inline directories (Eric Whitney)  
- ext4: fix cgroup writeback accounting with fs-layer encryption (Eric Biggers)  
- staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss() (Hans de Goede)  
- drm/connector: print max_requested_bpc in state debugfs (Harry Wentland)  
- drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15 (Alex Deucher)  
- x86/CPU/AMD: Disable XSAVES on AMD family 0x17 (Andrew Cooper)  
- fork: allow CLONE_NEWTIME in clone3 flags (Tobias Klauser)  
- perf inject: Fix --buildid-all not to eat up MMAP2 (Namhyung Kim)  
- btrfs: fix percent calculation for bg reclaim message (Johannes Thumshirn)  
- LTS version: v5.15.102 (Jack Vogel)  
- staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh (Philipp Hortmann)  
- staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script (Philipp Hortmann)  
- wifi: cfg80211: Partial revert 'wifi: cfg80211: Fix use after free for wext' (Hector Martin)  
- LTS version: v5.15.101 (Jack Vogel)  
- Revert 'drm/i915: Don't use BAR mappings for ring buffers with LLC' (Greg Kroah-Hartman)  
- LTS version: v5.15.100 (Jack Vogel)  
- usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails (Yang Yingliang)  
- malidp: Fix NULL vs IS_ERR() checking (Miaoqian Lin)  
- scsi: mpt3sas: Remove usage of dma_get_required_mask() API (Sreekanth Reddy)  
- scsi: mpt3sas: re-do lost mpt3sas DMA mask fix (Sreekanth Reddy)  
- scsi: mpt3sas: Don't change DMA mask while reallocating pools (Sreekanth Reddy)  
- Revert 'scsi: mpt3sas: Fix return value check of dma_get_required_mask()' (Salvatore Bonaccorso)  
- drm/virtio: Fix error code in virtio_gpu_object_shmem_init() (Harshit Mogalapalli)  
- media: uvcvideo: Fix race condition with usb_kill_urb (Ricardo Ribalda)  
- Bluetooth: hci_sock: purge socket queues in the destruct() callback (Nguyen Dinh Phi)  
- drm/display/dp_mst: Fix down message handling after a packet reception error (Imre Deak)  
- drm/display/dp_mst: Fix down/up message handling after sink disconnect (Imre Deak)  
- x86/resctl: fix scheduler confusion with 'current' (Linus Torvalds)  
- net: tls: avoid hanging tasks on the tx_lock (Jakub Kicinski)  
- soundwire: cadence: Drain the RX FIFO after an IO timeout (Richard Fitzgerald)  
- soundwire: cadence: Remove wasted space in response_buf (Richard Fitzgerald)  
- phy: rockchip-typec: Fix unsigned comparison with less than zero (Jiapeng Chong)  
- PCI: Add ACS quirk for Wangxun NICs (Mengyuan Lou)  
- PCI: loongson: Add more devices that need MRRS quirk (Huacai Chen)  
- kernel/fail_function: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- drivers: base: dd: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- drivers: base: component: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- misc: vmw_balloon: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- tty: pcn_uart: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- PCI: Take other bus devices into account when distributing resources (Mika Westerberg)  
- PCI: Align extra resources for hotplug bridges properly (Mika Westerberg)  
- usb: gadget: uvc: Make bSourceID read/write (Daniel Scally)  
- usb: uvc: Enumerate valid values for color matching (Daniel Scally)  
- USB: ene_usb6250: Allocate enough memory for full object (Kees Cook)  
- usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math (Kees Cook)  
- USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: gadget: gr_udc: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: isp1362: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: isp116x: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: fotg210: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: sl811: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: uhci: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: chipidea: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- USB: dwc3: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- PCI: loongson: Prevent LS7A MRRS increases (Huacai Chen)  
- soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe() (Richard Fitzgerald)  
- iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() (Harshit Mogalapalli)  
- iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() (Harshit Mogalapalli)  
- tools/iio/iio_utils:fix memory leak (Yulong Zhang)  
- mei: bus-fixup:upon error print return values of send and receive (Alexander Usyskin)  
- serial: sc16is7xx: setup GPIO controller later in probe (Isaac True)  
- tty: serial: fsl_lpuart: disable the CTS when send break signal (Sherry Sun)  
- tty: fix out-of-bounds access in tty_driver_lookup_tty() (Sven Schnelle)  
- staging: emxx_udc: Add checks for dma_alloc_coherent() (Yuan Can)  
- USB: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- media: uvcvideo: Silence memcpy() run-time false positive warnings (Kees Cook)  
- media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 (Ricardo Ribalda)  
- media: uvcvideo: Handle errors from calls to usb_string (Guenter Roeck)  
- media: uvcvideo: Handle cameras with invalid descriptors (Ricardo Ribalda)  
- media: uvcvideo: Remove format descriptions (Laurent Pinchart)  
- iommu/amd: Fix error handling for pdev_pri_ats_enable() (Vasant Hegde)  
- IB/hfi1: Update RMT size calculation (Dean Luick)  
- mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak (Liang He)  
- bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support (Souradeep Chowdhury)  
- firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 (Darrell Kavanagh)  
- kernel/printk/index.c: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman)  
- tracing: Add NULL checks for buffer in ring_buffer_free_read_page() (Jia-Ju Bai)  
- thermal: intel: BXT_PMIC: select REGMAP instead of depending on it (Randy Dunlap)  
- thermal: intel: quark_dts: fix error pointer dereference (Dan Carpenter)  
- ASoC: mediatek: mt8195: add missing initialization (Trevor Wu)  
- ASoC: zl38060 add gpiolib dependency (Arnd Bergmann)  
- ASoC: zl38060: Remove spurious gpiolib select (Mark Brown)  
- ASoC: adau7118: don't disable regulators on device unbind (Nuno Sa)  
- loop: loop_set_status_from_info() check before assignment (Zhong Jinghua)  
- rtc: allow rtc_read_alarm without read_alarm callback (Alexandre Belloni)  
- scsi: ipr: Work around fortify-string warning (Arnd Bergmann)  
- genirq: Add and use an irq_data_update_affinity helper (Samuel Holland)  
- genirq: Refactor accessors to use irq_data_get_affinity_mask (Samuel Holland)  
- rtc: sun6i: Always export the internal oscillator (Samuel Holland)  
- vc_screen: modify vcs_size() handling in vcs_read() (George Kennedy)  
- tcp: tcp_check_req() can be called from process context (Eric Dumazet)  
- ARM: dts: spear320-hmi: correct STMPE GPIO compatible (Krzysztof Kozlowski)  
- net/sched: act_sample: fix action bind logic (Pedro Tammela)  
- net/sched: act_mpls: fix action bind logic (Pedro Tammela)  
- net/sched: act_pedit: fix action bind logic (Pedro Tammela)  
- net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela)  
- nfc: fix memory leak of se_io context in nfc_genl_se_io (Fedor Pchelkin)  
- net/mlx5: Geneve, Fix handling of Geneve object id as error code (Maor Dickman)  
- net/mlx5e: Verify flow_source cap before using it (Roi Dayan)  
- 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() (Zhengchao Shao)  
- 9p/xen: fix connection sequence (Juergen Gross)  
- 9p/xen: fix version parsing (Juergen Gross)  
- net: fix __dev_kfree_skb_any() vs drop monitor (Eric Dumazet)  
- octeontx2-pf: Use correct struct reference in test condition (Deepak R Varma)  
- sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (Xin Long)  
- ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (Lu Wei)  
- netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (Pavel Tikhomirov)  
- netfilter: ebtables: fix table blob use-after-free (Florian Westphal)  
- netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Hangyu Hua)  
- watchdog: sbsa_wdog: Make sure the timeout programming is within the limits (George Cherian)  
- watchdog: pcwd_usb: Fix attempting to access uninitialized memory (Li Hua)  
- watchdog: Fix kmemleak in watchdog_cdev_register (Chen Jun)  
- watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path (ruanjinjie)  
- um: virt-pci: properly remove PCI device from bus (Benjamin Berg)  
- um: virtio_uml: move device breaking into workqueue (Benjamin Berg)  
- um: virtio_uml: mark device as unregistered when breaking it (Benjamin Berg)  
- um: virtio_uml: free command if adding to virtqueue failed (Benjamin Berg)  
- x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list (Ammar Faizi)  
- netfilter: nf_tables: allow to fetch set elements when table has an owner (Pablo Neira Ayuso)  
- ext4: use ext4_fc_tl_mem in fast-commit replay path (Eric Biggers)  
- f2fs: fix to avoid potential memory corruption in __update_iostat_latency() (Yangtao Li)  
- ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (Zhihao Cheng)  
- ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() (Zhihao Cheng)  
- ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap (Zhihao Cheng)  
- ubifs: ubifs_writepage: Mark page dirty after writing inode failed (Zhihao Cheng)  
- ubifs: dirty_cow_znode: Fix memleak in error handling path (Zhihao Cheng)  
- ubifs: Re-statistic cleaned znode count if commit failed (Zhihao Cheng)  
- ubi: Fix possible null-ptr-deref in ubi_free_volume() (Yang Yingliang)  
- ubifs: Fix memory leak in alloc_wbufs() (Li Zetao)  
- ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (Li Zetao)  
- ubi: Fix use-after-free when volume resizing failed (Li Zetao)  
- ubifs: Reserve one leb for each journal head while doing budget (Zhihao Cheng)  
- ubifs: do_rename: Fix wrong space budget when target inode's nlink &gt; 1 (Zhihao Cheng)  
- ubifs: Fix wrong dirty space budget for dirty inode (Zhihao Cheng)  
- ubifs: Rectify space budget for ubifs_xrename() (Zhihao Cheng)  
- ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted (Zhihao Cheng)  
- ubifs: Fix build errors as symbol undefined (Li Hua)  
- ubi: ensure that VID header offset + VID header size &lt;= alloc, size (George Kennedy)  
- um: vector: Fix memory leak in vector_config (Xiang Yang)  
- f2fs: allow set compression option of files without blocks (Yangtao Li)  
- fs: f2fs: initialize fsdata in pagecache_write() (Alexander Potapenko)  
- f2fs: use memcpy_{to,from}_page() where possible (Eric Biggers)  
- pwm: stm32-lp: fix the check on arr and cmp registers update (Fabrice Gasnier)  
- pwm: sifive: Always let the first pwm_apply_state succeed (Emil Renner Berthing)  
- pwm: sifive: Reduce time the controller lock is held (Uwe Kleine-Konig)  
- objtool: Fix memory leak in create_static_call_sections() (Miaoqian Lin)  
- fs/jfs: fix shift exponent db_agl2size negative (Liu Shixin via Jfs-discussion)  
- auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() (Jianglei Nie)  
- LTS version: v5.15.99 (Jack Vogel)  
- kbuild: Port silent mode detection to future gnu make. (Dmitry Goncharov)  
- wifi: ath9k: use proper statements in conditionals (Arnd Bergmann)  
- arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY (Robert Marko)  
- iommu/vt-d: Fix an unbalanced rcu_read_lock/rcu_read_unlock() (Christophe JAILLET)  
- media: uvcvideo: Fix memory leak of object map on error exit path (Colin Ian King)  
- qede: avoid uninitialized entries in coal_entry array (Michal Schmidt)  
- perf intel-pt: pkt-decoder: Add CFE and EVD packets (Adrian Hunter)  
- drm/edid: fix AVI infoframe aspect ratio handling (Jani Nikula)  
- drm/i915: Don't use BAR mappings for ring buffers with LLC (John Harrison)  
- drm/radeon: Fix eDP for single-display iMac11,2 (Mark Hawrylak)  
- drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv (Mavroudis Chatzilaridis)  
- vfio/type1: restore locked_vm (Steve Sistare)  
- vfio/type1: track locked_vm per dma (Steve Sistare)  
- vfio/type1: prevent underflow of locked_vm via exec() (Steve Sistare)  
- iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode (Jacob Pan)  
- PCI: Avoid FLR for AMD FCH AHCI adapters (Damien Le Moal)  
- PCI: hotplug: Allow marking devices as disconnected during bind/unbind (Lukas Wunner)  
- PCI/PM: Observe reset delay irrespective of bridge_d3 (Lukas Wunner)  
- MIPS: DTS: CI20: fix otg power gpio (H. Nikolaus Schaller)  
- riscv: ftrace: Reduce the detour code size to half (Guo Ren)  
- riscv: ftrace: Remove wasted nops for !RISCV_ISA_C (Guo Ren)  
- riscv, mm: Perform BPF exhandler fixup on page fault (Bjorn Topel)  
- riscv: jump_label: Fixup unaligned arch_static_branch function (Andy Chiu)  
- riscv: mm: fix regression due to update_mmu_cache change (Sergey Matyukevich)  
- RISC-V: add a spin_shadow_stack declaration (Conor Dooley)  
- scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (Tomas Henzl)  
- scsi: ses: Fix possible desc_ptr out-of-bounds accesses (Tomas Henzl)  
- scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (Tomas Henzl)  
- scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() (Tomas Henzl)  
- scsi: ses: Don't attach if enclosure has no components (James Bottomley)  
- tools/bootconfig: fix single &amp; used for logical condition (Antonio Alvarez Feijoo)  
- ring-buffer: Handle race between rb_move_tail and rb_check_pages (Mukesh Ojha)  
- ktest.pl: Add RUN_TIMEOUT option with default unlimited (Steven Rostedt)  
- ktest.pl: Fix missing 'end_monitor' when machine check fails (Steven Rostedt)  
- ktest.pl: Give back console on Ctrt^C on monitor (Steven Rostedt)  
- mm/thp: check and bail out if page in deferred queue already (Yin Fengwei)  
- mm: memcontrol: deprecate charge moving (Johannes Weiner)  
- docs: gdbmacros: print newest record (John Ogness)  
- remoteproc/mtk_scp: Move clk ops outside send_lock (Chen-Yu Tsai)  
- media: ipu3-cio2: Fix PM runtime usage_count in driver unbind (Sakari Ailus)  
- mips: fix syscall_get_nr (Elvira Khabirova)  
- dax/kmem: Fix leak of memory-hotplug resources (Dan Williams)  
- alpha: fix FEN fault handling (Al Viro)  
- ceph: update the time stamps and try to drop the suid/sgid (Xiubo Li)  
- rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (Ilya Dryomov)  
- fuse: add inode/permission checks to fileattr_get/fileattr_set (Alexander Mikhalitsyn)  
- ARM: dts: exynos: correct TMU phandle in Odroid HC1 (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Odroid XU (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Exynos5250 (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Odroid XU3 family (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Exynos4 (Krzysztof Kozlowski)  
- ARM: dts: exynos: correct TMU phandle in Exynos4210 (Krzysztof Kozlowski)  
- ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node (Manivannan Sadhasivam)  
- dm flakey: fix a bug with 32-bit highmem systems (Mikulas Patocka)  
- dm flakey: don't corrupt the zero page (Mikulas Patocka)  
- dm flakey: fix logic when corrupting a bio (Mikulas Patocka)  
- thermal: intel: powerclamp: Fix cur_state for multi package system (Srinivas Pandruvada)  
- qede: fix interrupt coalescing configuration (Manish Chopra)  
- wifi: cfg80211: Fix use after free for wext (Alexander Wetzel)  
- wifi: ath11k: allow system suspend to survive ath11k (Len Brown)  
- wifi: rtl8xxxu: Use a longer retry limit of 48 (Bitterblue Smith)  
- dm: add cond_resched() to dm_wq_work() (Pingfan Liu)  
- dm: send just one event on resize, not two (Mikulas Patocka)  
- mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type (Louis Rannou)  
- mtd: spi-nor: spansion: Consider reserved bits in CFR5 register (Tudor Ambarus)  
- mtd: spi-nor: sfdp: Fix index value for SCCR dwords (Takahiro Kuwano)  
- ext4: refuse to create ea block when umounted (Jun Nie)  
- ext4: optimize ea_inode block expansion (Jun Nie)  
- jbd2: fix data missing when reusing bh which is ready to be checkpointed (Zhihao Cheng)  
- ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC (Lukasz Stelmach)  
- ALSA: ice1712: Do not left ice-&gt;gpio_mutex locked in aureon_add_controls() (Dmitry Fomin)  
- io_uring/poll: allow some retries for poll triggering spuriously (Jens Axboe)  
- io_uring: remove MSG_NOSIGNAL from recvmsg (David Lamparter)  
- io_uring/rsrc: disallow multi-source reg buffers (Pavel Begunkov)  
</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2023-12339.html" type="self" title="ELSA-2023-12339" />
      <reference href="https://linux.oracle.com/cve/CVE-2023-30456.html" id="CVE-2023-30456" type="cve" title="CVE-2023-30456" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="kernel-uek-debug-devel" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-devel-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">1375c065177d2d325aeffd9e36459d98bcf5f861bb843e6be627cb5a63d82684</sum>
        </package>
        <package name="kernel-uek-modules-extra" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-modules-extra-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">d2ff09e7059ba60e192e45569e0365404c33d3002d27b6a5b7a81123571162b9</sum>
        </package>
        <package name="kernel-uek-debug" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">7bcf06d4628124f664c436646335ac5723d8087ccfbe4b5274ed8f19672deafc</sum>
        </package>
        <package name="kernel-uek-debug-core" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-core-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">e15353147dd39d2863bdd63764cb99c6c6f37a3955c9ab422cc628f622d70a91</sum>
        </package>
        <package name="kernel-uek" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="src">
          <filename>kernel-uek-5.15.0-101.103.2.1.el9uek.src.rpm</filename>
          <sum type="sha256">3709c44c0532500c5dd5ad99fef80114adba0f5f04c446cc554fc33bef65f061</sum>
        </package>
        <package name="kernel-uek" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">9fa8d6cda528656b3abfc3973c7d46f927785f36fc38958ad50710e8a9b14be0</sum>
        </package>
        <package name="kernel-uek-doc" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="noarch">
          <filename>kernel-uek-doc-5.15.0-101.103.2.1.el9uek.noarch.rpm</filename>
          <sum type="sha256">299746608d1a9616d800bab8abadfe0e57a8e83384a74e8db1527c6db612c03a</sum>
        </package>
        <package name="kernel-uek-modules" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-modules-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">ede9d438464ace00530ad726f72159e312fd31e71ae6aa415023f05cae2eb69a</sum>
        </package>
        <package name="kernel-uek-debug-modules" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-modules-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">8f117f75b58b400f8863a5c6f6057adec257c3b4dcf09e81bcff4d4cfd780f61</sum>
        </package>
        <package name="kernel-uek-debug-modules-extra" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-debug-modules-extra-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">4e29abca2b933f39450cc939fb9c0dd02bafabd8f24f02ac056b3c2015fc1f63</sum>
        </package>
        <package name="kernel-uek-core" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-core-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">951cec2811310578ffeb6f70bff87569f1e49e9fa6e597040e356ab8a1c15c53</sum>
        </package>
        <package name="kernel-uek-devel" version="5.15.0" release="101.103.2.1.el9uek" epoch="0" arch="aarch64">
          <filename>kernel-uek-devel-5.15.0-101.103.2.1.el9uek.aarch64.rpm</filename>
          <sum type="sha256">634ccb1609d56bf859d5d1d529240453c153673b297de67837f0cbd9b6b2f623</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update status="final" type="security" version="1" from="el-errata@oss.oracle.com">
    <id>ELSA-2026-50346</id>
    <title> gnutls  security fix update</title>
    <severity>Important</severity>
    <release>Oracle Linux 9</release>
    <issued date="2026-06-24 00:00:00"/>
    <updated date="2026-06-24 00:00:00"/>
    <rights>Copyright 2026 Oracle, Inc.</rights>
    <description>[3.8.10-4_fips]
- Add FIPS package change: add fips suffix to Release and
  set Epoch to 10 [Orabug: 35925409]
- Update FIPS module name for Oracle Linux [Orabug: 35925409]

[3.8.10-4]
- Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite)
- Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour)
- Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread)
- Fix CVE-2026-42010 (PSK authentication, High, authentication bypass)
- Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass)
- Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass)
- Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse)
- Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse)
- Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free)
- Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread)
- Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite)
- Fix CVE-2026-3832 (OCSP, Low, revocation bypass)
- Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel)
- Fix upstream security issue #1808 (PSK rehandshake)
- Fix upstream security issue #1810 (EKU OID prefix match)
- Fix upstream security issue #1813 (pkcs11-provider persistent keys)
- Fix upstream security issue #1818 (RSA correctness, OpenSSL format import)
- Fix upstream security issue #1819 (PKCS#11 trust removal error path)
- Fix upstream security issue #1822 (SCT extension parser OOB read)
- Fix upstream security issue #1841 (key zeroization in hybrid kex)
- Fix upstream security issue #1823 (malformed certtool template)
- Fix upstream security issue #1817 (session parameter loading robustness)
- Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving)
- gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in

[3.8.10-3]
- Fix PKCS#11 token initialization label overflow (CVE-2025-9820)
- Fix name constraint processing performance issue (CVE-2025-14831)

[3.8.10-2]
- Reinstate and update the prematurely dropped rekeying patch

[3.8.10-1]
- Rebase to 3.8.10
- Revert defaulting to PBMAC1 in FIPS mode
- Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification</description>
    <solution>This update is available via the Unbreakable Linux Network (ULN) and the Oracle Public Yum Server. Details on how to use ULN or http://public-yum.oracle.com to apply this update are available at http://linux.oracle.com/applying_updates.html.</solution>
    <references>
      <reference href="https://linux.oracle.com/errata/ELSA-2026-50346.html" type="self" title="ELSA-2026-50346" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-33845.html" id="CVE-2026-33845" type="cve" title="CVE-2026-33845" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-33846.html" id="CVE-2026-33846" type="cve" title="CVE-2026-33846" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-3832.html" id="CVE-2026-3832" type="cve" title="CVE-2026-3832" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-3833.html" id="CVE-2026-3833" type="cve" title="CVE-2026-3833" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-42009.html" id="CVE-2026-42009" type="cve" title="CVE-2026-42009" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-42010.html" id="CVE-2026-42010" type="cve" title="CVE-2026-42010" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-42011.html" id="CVE-2026-42011" type="cve" title="CVE-2026-42011" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-42012.html" id="CVE-2026-42012" type="cve" title="CVE-2026-42012" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-42013.html" id="CVE-2026-42013" type="cve" title="CVE-2026-42013" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-42014.html" id="CVE-2026-42014" type="cve" title="CVE-2026-42014" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-42015.html" id="CVE-2026-42015" type="cve" title="CVE-2026-42015" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-5260.html" id="CVE-2026-5260" type="cve" title="CVE-2026-5260" />
      <reference href="https://linux.oracle.com/cve/CVE-2026-5419.html" id="CVE-2026-5419" type="cve" title="CVE-2026-5419" />
    </references>
    <pkglist>
      
      <collection short="ol9_aarch64_u3_security_validation">
        <name>ol9_aarch64_u3_security_validation</name>
        <package name="gnutls-devel" version="3.8.10" release="4.el9_8_fips" epoch="10" arch="aarch64">
          <filename>gnutls-devel-3.8.10-4.el9_8_fips.aarch64.rpm</filename>
          <sum type="sha256">cf7e1eb0c2414b20aad1c83525f18062de6c31943caba104c6d4d8a5b9c76496</sum>
        </package>
        <package name="gnutls" version="3.8.10" release="4.el9_8_fips" epoch="10" arch="src">
          <filename>gnutls-3.8.10-4.el9_8_fips.src.rpm</filename>
          <sum type="sha256">3666641828e2a94d6f0e130ac03010e8697e5f19cbe650071463e295aa39c766</sum>
        </package>
        <package name="gnutls-c++" version="3.8.10" release="4.el9_8_fips" epoch="10" arch="aarch64">
          <filename>gnutls-c++-3.8.10-4.el9_8_fips.aarch64.rpm</filename>
          <sum type="sha256">ef3aa07a041fd0eed759156e4d7c51db15aaf0913701d9eb17d1ff673c8a2b33</sum>
        </package>
        <package name="gnutls" version="3.8.10" release="4.el9_8_fips" epoch="10" arch="aarch64">
          <filename>gnutls-3.8.10-4.el9_8_fips.aarch64.rpm</filename>
          <sum type="sha256">629fc8829ad23a9634d77ee18c266ae39d8e490928f922ecee4fc6c4e65f331f</sum>
        </package>
        <package name="gnutls-utils" version="3.8.10" release="4.el9_8_fips" epoch="10" arch="aarch64">
          <filename>gnutls-utils-3.8.10-4.el9_8_fips.aarch64.rpm</filename>
          <sum type="sha256">b7c6bb709fef1425d64c8dc3e6c1f95e332eebb18f010ad942c1187206a6aa1f</sum>
        </package>
        <package name="gnutls-dane" version="3.8.10" release="4.el9_8_fips" epoch="10" arch="aarch64">
          <filename>gnutls-dane-3.8.10-4.el9_8_fips.aarch64.rpm</filename>
          <sum type="sha256">192d4f554fea2c8783af187153e06b2bdad83c0dc4ee34bc29d2a4d3af10a238</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>