# changelog

author: chenyi <chenyi211@huawei.com> - 4.19.90-2504.2.0.0323
changelog:
  - !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
  - !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
  - !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
  - !15377  virtio_console: eliminate anonymous module_init & module_exit
  - bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
  - dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
  - !15784  HID: betop: check shape of output reports
  - HID: betop: check shape of output reports
  - !15740  ftrace: Avoid potential division by zero in function_stat_show()
  - !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
  - !15637  net_sched: sch_sfq: don't allow 1 packet limit
  - !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
  - !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
  - !15638  CVE-2022-49374
  - !15692  tty: fix deadlock caused by calling printk() under tty_port->lock
  - !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
  - !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
  - !15691  media: uvcvideo: Fix double free in error path
  - !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
  - !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
  - dmaengine: Fix double increment of client_count in dma_chan_get()
  - EDAC/highbank: Fix memory leak in highbank_mc_probe()
  - bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
  - ftrace: Avoid potential division by zero in function_stat_show()
  - !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
  - drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
  - !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
  - !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
  - !15632  macsec: fix UAF bug for real_dev
  - !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  - !15688  usb: usbip: fix a refcount leak in stub_probe()
  - !15713  CVE-2022-49370
  - !15712  drbd: Fix five use after free bugs in get_initial_state
  - !15619  partitions: mac: fix handling of bogus partition table
  - !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
  - !15720  nfc: nci: add flush_workqueue to prevent uaf
  - phy: qcom-qmp: fix reset-controller leak on probe errors
  - nfc: nci: add flush_workqueue to prevent uaf
  - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
  - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
  - drbd: Fix five use after free bugs in get_initial_state
  - fs/dcache: fix bad unlock balance in shrink_dentry_list()
  - firmware: arm_scmi: Fix list protocols enumeration in the base protocol
  - rxrpc: Fix listen() setting the bar too high for the prealloc rings
  - tty: fix deadlock caused by calling printk() under tty_port->lock
  - media: uvcvideo: Fix double free in error path
  - usb: usbip: fix a refcount leak in stub_probe()
  - drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  - drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
  - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
  - tipc: check attribute length for bearer name
  - tipc: add extack messages for bearer/media failure
  - net_sched: sch_sfq: don't allow 1 packet limit
  - macsec: fix UAF bug for real_dev
  - partitions: mac: fix handling of bogus partition table
  - cpufreq: pmac32-cpufreq: Fix refcount leak bug
  - virtio_console: eliminate anonymous module_init & module_exit


author: chenyi <chenyi211@huawei.com> - 4.19.90-2504.3.0.0324
changelog:
  - !15862  tty: goldfish: Use tty_port_destroy() to destroy port
  - tty: goldfish: Use tty_port_destroy() to destroy port
  - !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  - !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  - !15664  CVE-2025-21858
  - !15815  dm raid: fix accesses beyond end of raid member array
  - !15368  nfsd: clear acl_access/acl_default after releasing them
  - !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
  - vc_screen: don't clobber return value in vcs_read
  - vc_screen: modify vcs_size() handling in vcs_read()
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
  - !15380  media: cx25821: Fix the warning when removing the module
  - !15649  media: uvcvideo: Remove dangling pointers
  - !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
  - dm raid: fix accesses beyond end of raid member array
  - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
  - geneve: Suppress list corruption splat in geneve_destroy_tunnels().
  - geneve: Fix use-after-free in geneve_find_dev().
  - media: uvcvideo: Remove dangling pointers
  - media: cx25821: Fix the warning when removing the module
  - nfsd: clear acl_access/acl_default after releasing them
  - NFSD: prevent underflow in nfssvc_decode_writeargs()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2504.4.0.0325
changelog:
  - !15624  proc: fix use-after-free in proc_get_inode()
  - !15900  Backport mainline patches to avoid crash caused by rsize being 0
  - !15820  io_uring: prevent opcode speculation
  - !15751  fix-CVE-2022-49538
  - !15914  block: fix resource leak in blk_register_queue() error path
  - !15930  loop: fix UAF in mutex_spin_on_owner()
  - loop: loop_set_status_from_info() check before assignment
  - Revert "loop: loop_set_status_from_info() check before assignment"
  - block: fix resource leak in blk_register_queue() error path
  - smb: client: Update IO sizes after reconnection
  - smb: client: Store original IO parameters and prevent zero IO sizes
  - smb:client: smb: client: Add reverse mapping from tcon to superblocks
  - Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0"
  - !15830  ASoC: rt5645: Fix errorenous cleanup order
  - ASoC: rt5645: Fix errorenous cleanup order
  - io_uring: prevent opcode speculation
  - ALSA: jack: Fix mutex call in snd_jack_report()
  - ALSA: jack: Access input_dev under mutex
  - proc: fix use-after-free in proc_get_inode()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.1.0.0326
changelog:
  - !16154  driver: base: fix UAF when driver_attach failed
  - !16148 v2  ipv6: mcast: extend RCU protection in igmp6_send()
  - !16153  scsi: pm8001: Fix abort all task initialization
  - !16152  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
  - !16107  qede: confirm skb is allocated before using
  - !16112  mpage: fix softlockup in mpage_readahead()
  - !16104  md/raid1,raid10: don't ignore IO flags
  - driver: base: fix UAF when driver_attach failed
  - !16151  can: peak_usb: fix use after free bugs
  - scsi: pm8001: Fix abort all task initialization
  - video: fbdev: cirrusfb: check pixclock to avoid divide by zero
  - !16131  net: mdio: validate parameter addr in mdiobus_get_phy()
  - can: peak_usb: fix use after free bugs
  - ipv6: mcast: extend RCU protection in igmp6_send()
  - !16142  CVE-2023-53023
  - !16077  CVE-2022-49626
  - !16078  CVE-2022-49429
  - net: nfc: Fix use-after-free in local_cleanup()
  - !16123  netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
  - !16122  ndisc: extend RCU protection in ndisc_send_skb()
  - !16111  arp: use RCU protection in arp_xmit()
  - !16110  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
  - !16109  net: Fix CVE-2025-21763
  - !16126  net: openvswitch: fix leak of nested actions
  - net: mdio: validate parameter addr in mdiobus_get_phy()
  - net: openvswitch: fix leak of nested actions
  - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
  - ndisc: extend RCU protection in ndisc_send_skb()
  - mpage: fix softlockup in mpage_readahead()
  - arp: use RCU protection in arp_xmit()
  - openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
  - neighbour: use RCU protection in __neigh_notify()
  - neighbour: delete redundant judgment statements
  - qede: confirm skb is allocated before using
  - md/raid1,raid10: don't ignore IO flags
  - !16082  CVE-2021-47668
  - !16089  mm/khugepaged: fix ->anon_vma race
  - !16071  Backport SMC patchs
  - mm/khugepaged: fix ->anon_vma race
  - !16054  jfs: add check read-only before truncation in jfs_truncate_nolock()
  - can: dev: can_restart: fix use after free bug
  - can: dev: can_restart(): post buffer from the right context
  - RDMA/hfi1: Prevent panic when SDMA is disabled
  - sfc: fix use after free when disabling sriov
  - sfc: error code if SRIOV cannot be disabled
  - net/smc: fix restoring of fallback changes
  - net/smc: fix closing of fallback SMC sockets
  - net/smc: propagate file from SMC to TCP socket
  - !16067  net: fix geneve_opt length integer overflow
  - !16058  udp: Fix memory accounting leak.
  - !16029  CVE-2022-49647
  - !16064  ndisc: Fix CVE-2025-21764
  - net: fix geneve_opt length integer overflow
  - ndisc: use RCU protection in ndisc_alloc_skb()
  - net: add dev_net_rcu() helper
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
  - udp: Fix memory accounting leak.
  - !15781  drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
  - !15780  staging: rtl8712: fix uninit-value in r871xu_drv_init()
  - jfs: add check read-only before truncation in jfs_truncate_nolock()
  - !16032  net: atm: fix use after free in lec_send()
  - net: atm: fix use after free in lec_send()
  - cgroup: fix kabi for css_set
  - cgroup: Use separate src/dst nodes when preloading css_sets for migration
  - !15993  Fix CVE-2025-37785
  - !15984  vlan: enforce underlying device type
  - ext4: fix OOB read when checking dotdot dir
  - ext4: optimize __ext4_check_dir_entry()
  - !15978  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
  - vlan: enforce underlying device type
  - !15953  Fix CVE-2020-36789
  - !15957  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
  - tracing: Fix use-after-free in print_graph_function_flags during tracer switching
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
  - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
  - drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
  - staging: rtl8712: fix uninit-value in r871xu_drv_init()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.3.0.0327
changelog:
  - !16177  Fix CVE-2022-49850
  - !16176  Fix CVE-2022-49842
  - !16187  ata: libata-transport: fix double ata_host_put() in ata_tport_add()
  - !16188  nvmet: avoid potential UAF in nvmet_req_complete()
  - !16238  dm ioctl: fix misbehavior if list_versions races with module loading
  - !16200  drm/amdkfd: Fix an illegal memory access
  - dm ioctl: fix misbehavior if list_versions races with module loading
  - !16175  Fix CVE-2022-49915
  - drm/amdkfd: Fix an illegal memory access
  - nvmet: avoid potential UAF in nvmet_req_complete()
  - ata: libata-transport: fix double ata_host_put() in ata_tport_add()
  - nilfs2: fix deadlock in nilfs_count_free_blocks()
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
  - ASoC: core: Fix use-after-free in snd_soc_exit()
  - mISDN: fix misuse of put_device() in mISDN_register_device()
  - mISDN: fix possible memory leak in mISDN_register_device()
  - !16139  Bluetooth: Fix use after free in hci_send_acl
  - !16140  NFC: NULL out the dev->rfkill to prevent UAF
  - !16145  CVE-2022-49755
  - usb: gadget: f_fs: Add unbind event before functionfs_unbind
  - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
  - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
  - NFC: NULL out the dev->rfkill to prevent UAF
  - Bluetooth: Fix use after free in hci_send_acl


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.4.0.0328
changelog:
  - !15445 Add IOAPIC support for Hygon family 18h model 10h
  - !15444 Add LS and IF mce types for Hygon family 18h model 7h
  - !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
  - !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
  - !16203  ext4: fix off-by-one error in do_split
  - !16221  jbd2: remove wrong sb->s_sequence check
  - !16205  ext4: update s_journal_inum if it changes after journal replay
  - !16288  scsi: core: Clear driver private data when retrying request
  - bpf: Fix WARN() in get_bpf_raw_tp_regs
  - !15446 Add support for Hygon family 18h model 8h
  - !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
  - !16290  CVE-2024-57982
  - !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
  - !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
  - !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
  - mISDN: fix possible memory leak in mISDN_dsp_element_register()
  - net: fix kabi broken in struct netns_xfrm
  - xfrm: state: fix out-of-bounds read during lookup
  - net: xfrm: Localize sequence counter per network namespace
  - scsi: core: Clear driver private data when retrying request
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
  - x86: Enhanced copy capabilities for Hygon processor
  - kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
  - jbd2: remove wrong sb->s_sequence check
  - ext4: update s_journal_inum if it changes after journal replay
  - ext4: fix off-by-one error in do_split
  - EDAC/amd64: Add support for Hygon family 18h model 8h
  - x86/amd_nb: Add support for Hygon family 18h model 8h
  - iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
  - EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
  - x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.5.0.0329
changelog:
  - !16353  CVE-2022-49769
  - !16417  dm-bufio: don't schedule in atomic context
  - !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
  - !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
  - dm-bufio: don't schedule in atomic context
  - HID: hyperv: fix possible memory leak in mousevsc_probe()
  - !16375  CVE-2025-37752
  - net_sched: sch_sfq: move the limit validation
  - net_sched: sch_sfq: use a temporary work area for validating configuration
  - gfs2: Check sb_bsize_shift after reading superblock
  - gfs2: add validation checks for size of superblock


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.1.0.0330
changelog:
  - !16548  mm/vmscan: don't try to reclaim hwpoison folio
  - !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
  - !16294  fs/jfs: Prevent integer overflow in AG size calculation
  - mm/vmscan: don't try to reclaim hwpoison folio
  - !16534  memcg: always call cond_resched() after fn()
  - memcg: always call cond_resched() after fn()
  - !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
  - fs/jfs: Prevent integer overflow in AG size calculation


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.2.0.0331
changelog:
  - !16577  capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
  - !16306 [openEuler-1.0-LTS] scsi: libsas: Abort all in-flight requests when device is gone
  - !16583  module: ensure that kobject_put() is safe for module type kobjects
  - !16598  vgacon: Add check for vc_origin address range in vgacon_scroll()
  - !16616  pci:vga fix race condition in vga_arb_write
  - !16495  dm crypt: add cond_resched() to dmcrypt_write()
  - !16540  scsi: target: Fix WRITE_SAME No Data Buffer crash
  - pci:vga fix race condition in vga_arb_write
  - vgacon: Add check for vc_origin address range in vgacon_scroll()
  - module: ensure that kobject_put() is safe for module type kobjects
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
  - scsi: target: Fix WRITE_SAME No Data Buffer crash
  - scsi: libsas: Abort all in-flight requests when device is gone
  - dm crypt: add cond_resched() to dmcrypt_write()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.3.0.0332
changelog:
  - !16650  mm/vmscan: fix hwpoisoned THP handling in shrink_page_list
  - mm/vmscan: fix hwpoisoned THP handling in shrink_page_list


author: lingsheng <lingsheng1@h-partners.com> - 3.4.3-10
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: yixiangzhike <yixiangzhike007@163.com> - 2.15-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:avoid truncate trailer space and do not escape backslash when read filename


author: yixiangzhike <yixiangzhike007@163.com> - 2.15-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:revert "avoid truncate trailer space and do not escape backslash when read filename"


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


