# changelog

author: liuxu <liuxu156@huawei.com> - 1:1.31.1-21
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: fuanan <fuanan3@h-partners.com> - 2.27.0-19
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: fuanan <fuanan3@h-partners.com> - 2.27.0-25
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-46334 CVE-2025-46835
  - SUG:NA 
  - DESC:Fix CVE-2025-27613 CVE-2025-46334 CVE-2025-46835


author: fuanan <fuanan3@h-partners.com> - 2.27.0-26
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-46334 CVE-2025-46835
  - SUG:NA
  - DESC:refix CVE-2025-27613 CVE-2025-46334 CVE-2025-46835


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.4.0.0328
changelog:
  - !15445 Add IOAPIC support for Hygon family 18h model 10h
  - !15444 Add LS and IF mce types for Hygon family 18h model 7h
  - !16321  bpf: Fix WARN() in get_bpf_raw_tp_regs
  - !16293  mISDN: fix possible memory leak in mISDN_dsp_element_register()
  - !16203  ext4: fix off-by-one error in do_split
  - !16221  jbd2: remove wrong sb->s_sequence check
  - !16205  ext4: update s_journal_inum if it changes after journal replay
  - !16288  scsi: core: Clear driver private data when retrying request
  - bpf: Fix WARN() in get_bpf_raw_tp_regs
  - !15446 Add support for Hygon family 18h model 8h
  - !15356 Fix northbridge init warning in guest for Hygon family 18h model 4h
  - !16290  CVE-2024-57982
  - !16285  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
  - !16275  kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
  - !16199 [openEuler-1.0-LTS] Enhanced Hygon processor's processing capabilities for large memory copying
  - mISDN: fix possible memory leak in mISDN_dsp_element_register()
  - net: fix kabi broken in struct netns_xfrm
  - xfrm: state: fix out-of-bounds read during lookup
  - net: xfrm: Localize sequence counter per network namespace
  - scsi: core: Clear driver private data when retrying request
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
  - x86: Enhanced copy capabilities for Hygon processor
  - kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
  - jbd2: remove wrong sb->s_sequence check
  - ext4: update s_journal_inum if it changes after journal replay
  - ext4: fix off-by-one error in do_split
  - EDAC/amd64: Add support for Hygon family 18h model 8h
  - x86/amd_nb: Add support for Hygon family 18h model 8h
  - iommu/hygon: Add support for Hygon family 18h model 10h IOAPIC
  - EDAC/mce_amd: Add LS and IF mce types for Hygon family 18h model 7h
  - x86/amd_nb: Fix northbridge init warning in guest for Hygon family 18h model 4h


author: chenyi <chenyi211@huawei.com> - 4.19.90-2505.5.0.0329
changelog:
  - !16353  CVE-2022-49769
  - !16417  dm-bufio: don't schedule in atomic context
  - !16409  HID: hyperv: fix possible memory leak in mousevsc_probe()
  - !16425  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
  - dm-bufio: don't schedule in atomic context
  - HID: hyperv: fix possible memory leak in mousevsc_probe()
  - !16375  CVE-2025-37752
  - net_sched: sch_sfq: move the limit validation
  - net_sched: sch_sfq: use a temporary work area for validating configuration
  - gfs2: Check sb_bsize_shift after reading superblock
  - gfs2: add validation checks for size of superblock


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.1.0.0330
changelog:
  - !16548  mm/vmscan: don't try to reclaim hwpoison folio
  - !16511  media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
  - !16294  fs/jfs: Prevent integer overflow in AG size calculation
  - mm/vmscan: don't try to reclaim hwpoison folio
  - !16534  memcg: always call cond_resched() after fn()
  - memcg: always call cond_resched() after fn()
  - !16519  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
  - fs/jfs: Prevent integer overflow in AG size calculation


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.2.0.0331
changelog:
  - !16577  capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
  - !16306 [openEuler-1.0-LTS] scsi: libsas: Abort all in-flight requests when device is gone
  - !16583  module: ensure that kobject_put() is safe for module type kobjects
  - !16598  vgacon: Add check for vc_origin address range in vgacon_scroll()
  - !16616  pci:vga fix race condition in vga_arb_write
  - !16495  dm crypt: add cond_resched() to dmcrypt_write()
  - !16540  scsi: target: Fix WRITE_SAME No Data Buffer crash
  - pci:vga fix race condition in vga_arb_write
  - vgacon: Add check for vc_origin address range in vgacon_scroll()
  - module: ensure that kobject_put() is safe for module type kobjects
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
  - scsi: target: Fix WRITE_SAME No Data Buffer crash
  - scsi: libsas: Abort all in-flight requests when device is gone
  - dm crypt: add cond_resched() to dmcrypt_write()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.3.0.0332
changelog:
  - !16650  mm/vmscan: fix hwpoisoned THP handling in shrink_page_list
  - mm/vmscan: fix hwpoisoned THP handling in shrink_page_list


author: chenyi <chenyi211@huawei.com> - 4.19.90-2506.4.0.0333
changelog:
  - !16754  video: fbdev: amba-clcd: Fix refcount leak bugs
  - !16704  ima: prevent concurrent list operations in ima_lsm_update_rules
  - video: fbdev: amba-clcd: Fix refcount leak bugs
  - !16554 [openEuler-1.0-LTS] PCI: Supplement ACS quirk for more Zhaoxin Root Ports
  - PCI: Supplement ACS quirk for more Zhaoxin Root Ports
  - PCI: Add ACS quirk for more Zhaoxin Root Ports
  - ima: prevent concurrent list operations in ima_lsm_update_rules


author: chenyi <chenyi211@huawei.com> - 4.19.90-2507.1.0.0334
changelog:
  - !16854  ftrace: Fix UAF when lookup kallsym after ftrace disabled
  - !16802  tty: vt: initialize unicode screen buffer
  - !16856  ipvs: fix WARNING in ip_vs_app_net_cleanup()
  - ipvs: fix WARNING in ip_vs_app_net_cleanup()
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled
  - !16846  Fix CVE-2025-38058
  - !16835  erspan: do not use skb_mac_header() in ndo_start_xmit()
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
  - do_umount(): add missing barrier before refcount checks in sync case
  - !16834  kcm: close race conditions on sk_receive_queue
  - !16833  qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
  - !16832  net: usb: smsc95xx: Limit packet length to skb->len
  - !16831  CVE-2023-53125
  - erspan: do not use skb_mac_header() in ndo_start_xmit()
  - kcm: close race conditions on sk_receive_queue
  - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
  - net: usb: smsc95xx: Limit packet length to skb->len
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
  - net: usb: smsc75xx: Limit packet length to skb->len
  - !16823  hidraw:·fix·memory·leak·in·hidraw_release
  - HID: hidraw: fix a problem of memory leak in hidraw_release()
  - HID: hidraw: fix memory leak in hidraw_release()
  - !16811  ARM: OMAP2+: display: Fix refcount leak bug
  - !16796  spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
  - !16810  CVE-2022-50080
  - ARM: OMAP2+: display: Fix refcount leak bug
  - !16800  media: pvrusb2: fix memory leak in pvr_probe
  - tee: fix compiler warning in tee_shm_register()
  - tee: add overflow check in register_shm_helper()
  - tty: vt: initialize unicode screen buffer
  - media: pvrusb2: fix memory leak in pvr_probe
  - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions


author: chenyi <chenyi211@huawei.com> - 4.19.90-2507.2.0.0335
changelog:
  - !17017  ipvlan: Fix out-of-bounds caused by unclear skb->cb in I2e mode
  - !17018 v2  bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - !16962  firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
  - !16945  scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
  - !17021  dm raid: fix address sanitizer warning in raid_status
  - dm raid: fix address sanitizer warning in raid_status
  - !17005  sch_htb: Fix CVE-2025-37932
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - ipvlan: Fix out-of-bounds caused by unclear skb->cb in I2e mode
  - !16941 v2  dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  - sch_htb: make htb_deactivate() idempotent
  - sch_htb: make htb_qlen_notify() idempotent
  - !16987  PCI/GPU: fix hard lockup in vga_arb_release
  - !16974  iavf: Fix reset error handling
  - !16975  RDMA/rxe: Fix error unwind in rxe_create_qp()
  - !16976  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - !16978  usbnet: Fix linkwatch use-after-free on disconnect
  - !16979  RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
  - PCI/GPU: fix hard lockup in vga_arb_release
  - !16980  arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
  - !16923  PM: hibernate: defer device probing when resuming from hibernation
  - arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
  - RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
  - usbnet: Fix linkwatch use-after-free on disconnect
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - RDMA/rxe: Fix error unwind in rxe_create_qp()
  - iavf: Fix reset error handling
  - !16953  usb: host: ohci-ppc-of: Fix refcount leak bug
  - !16955  dm raid: fix address sanitizer warning in raid_resume
  - !16928  net: mdio: fix undefined behavior in bit shift for __mdiobus_register
  - !16929  tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
  - !16960  wifi: cfg80211: fix memory leak in query_regdb_file()
  - !16961  CVE-2022-49871
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
  - net: tun: call napi_schedule_prep() to ensure we own a napi
  - net: tun: Fix memory leaks of napi_get_frags
  - wifi: cfg80211: fix memory leak in query_regdb_file()
  - dm raid: fix address sanitizer warning in raid_resume
  - !16913  drm/amd/display: clear optc underflow before turn off odm clock
  - usb: host: ohci-ppc-of: Fix refcount leak bug
  - !16910  KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
  - !16931  md: call __md_stop_writes in md_stop
  - !16930  md-raid10: fix KASAN warning
  - scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  - !16506  ipvs: fix WARNING in __ip_vs_cleanup_batch()
  - !16505  net: sched: Fix use after free in red_enqueue()
  - !16917  nfs: handle failure of nfs_get_lock_context in unlock path
  - md: call __md_stop_writes in md_stop
  - md-raid10: fix KASAN warning
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register
  - !16920  net: atlantic: fix aq_vec index out of range error
  - !16921  net: tunnels: annotate lockless accesses to dev->needed_headroom
  - PM: hibernate: defer device probing when resuming from hibernation
  - !16907  crypto: algif_hash - fix double free in hash_accept
  - net: tunnels: annotate lockless accesses to dev->needed_headroom
  - !16890  sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
  - !16889  scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
  - net: atlantic: fix aq_vec index out of range error
  - !16876  hulk-4.19-fix-CVE-2022-49989
  - nfs: handle failure of nfs_get_lock_context in unlock path
  - !16904  wifi: mac80211: Fix UAF in ieee80211_scan_rx()
  - !16888  drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
  - drm/amd/display: clear optc underflow before turn off odm clock
  - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
  - !16824  cifs: fix small mempool leak in SMB2_negotiate()
  - !16825  smb: client: Fix use-after-free in cifs_fill_dirent
  - crypto: algif_hash - fix double free in hash_accept
  - !16900  regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
  - wifi: mac80211: Fix UAF in ieee80211_scan_rx()
  - regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
  - !16869  vt: Clear selection before changing the font
  - !16873  mtd: maps: Fix refcount leak in ap_flash_init
  - !16871  ALSA: bcd2000: Fix a UAF bug on the error path of probing
  - !16878  wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
  - !16867  drivers:md:fix a potential use-after-free bug
  - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
  - scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
  - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
  - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
  - xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
  - xen/privcmd: Corrected error handling path
  - mtd: maps: Fix refcount leak in ap_flash_init
  - ALSA: bcd2000: Fix a UAF bug on the error path of probing
  - vt: Clear selection before changing the font
  - drivers:md:fix a potential use-after-free bug
  - smb: client: Reset all search buffer pointers when releasing buffer
  - smb: client: Fix use-after-free in cifs_fill_dirent
  - cifs: fix small mempool leak in SMB2_negotiate()
  - ipvs: fix WARNING in __ip_vs_cleanup_batch()
  - net: sched: Fix use after free in red_enqueue()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2507.3.0.0336
changelog:
  - !17108  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17113  Bluetooth: btrtl: Prevent potential NULL dereference
  - Bluetooth: btrtl: Prevent potential NULL dereference
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17057  media: cxusb: no longer judge rbuf when the write fails
  - !17073  Revert "dm-bufio: don't schedule in atomic context"
  - Revert "dm-bufio: don't schedule in atomic context"
  - !17046 v2  net: Fix CVE-2025-38000
  - media: cxusb: no longer judge rbuf when the write fails
  - sch_cbq: make cbq_qlen_notify() idempotent
  - net/sched: Always pass notifications when child class becomes empty
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  - sch_qfq: make qfq_qlen_notify() idempotent
  - sch_hfsc: make hfsc_qlen_notify() idempotent
  - sch_drr: make drr_qlen_notify() idempotent


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2507.4.0.0337
changelog:
  - !17221  net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - !17147  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()


author: Funda Wang <fundawang@yeah.net> - 2.9.10-43
changelog:
  - Type:CVE
  - CVE:CVE-2024-56171
  - CVE:CVE-2025-24928
  - CVE:CVE-2025-27113
  - SUG:NA
  - DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113


author: Funda Wang <fundawang@yeah.net> - 2.9.10-47
changelog:
  - Type:CVE
  - CVE:CVE-2025-49794
  - CVE:CVE-2025-49796
  - SUG:NA
  - DESC: fix CVE-2025-49794, CVE-2025-49796


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


