# changelog

author: chenyi <chenyi211@huawei.com> - 4.19.90-2507.2.0.0335
changelog:
  - !17017  ipvlan: Fix out-of-bounds caused by unclear skb->cb in I2e mode
  - !17018 v2  bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - !16962  firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
  - !16945  scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
  - !17021  dm raid: fix address sanitizer warning in raid_status
  - dm raid: fix address sanitizer warning in raid_status
  - !17005  sch_htb: Fix CVE-2025-37932
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - ipvlan: Fix out-of-bounds caused by unclear skb->cb in I2e mode
  - !16941 v2  dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  - sch_htb: make htb_deactivate() idempotent
  - sch_htb: make htb_qlen_notify() idempotent
  - !16987  PCI/GPU: fix hard lockup in vga_arb_release
  - !16974  iavf: Fix reset error handling
  - !16975  RDMA/rxe: Fix error unwind in rxe_create_qp()
  - !16976  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - !16978  usbnet: Fix linkwatch use-after-free on disconnect
  - !16979  RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
  - PCI/GPU: fix hard lockup in vga_arb_release
  - !16980  arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
  - !16923  PM: hibernate: defer device probing when resuming from hibernation
  - arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
  - RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
  - usbnet: Fix linkwatch use-after-free on disconnect
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - RDMA/rxe: Fix error unwind in rxe_create_qp()
  - iavf: Fix reset error handling
  - !16953  usb: host: ohci-ppc-of: Fix refcount leak bug
  - !16955  dm raid: fix address sanitizer warning in raid_resume
  - !16928  net: mdio: fix undefined behavior in bit shift for __mdiobus_register
  - !16929  tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
  - !16960  wifi: cfg80211: fix memory leak in query_regdb_file()
  - !16961  CVE-2022-49871
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
  - net: tun: call napi_schedule_prep() to ensure we own a napi
  - net: tun: Fix memory leaks of napi_get_frags
  - wifi: cfg80211: fix memory leak in query_regdb_file()
  - dm raid: fix address sanitizer warning in raid_resume
  - !16913  drm/amd/display: clear optc underflow before turn off odm clock
  - usb: host: ohci-ppc-of: Fix refcount leak bug
  - !16910  KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
  - !16931  md: call __md_stop_writes in md_stop
  - !16930  md-raid10: fix KASAN warning
  - scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  - !16506  ipvs: fix WARNING in __ip_vs_cleanup_batch()
  - !16505  net: sched: Fix use after free in red_enqueue()
  - !16917  nfs: handle failure of nfs_get_lock_context in unlock path
  - md: call __md_stop_writes in md_stop
  - md-raid10: fix KASAN warning
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register
  - !16920  net: atlantic: fix aq_vec index out of range error
  - !16921  net: tunnels: annotate lockless accesses to dev->needed_headroom
  - PM: hibernate: defer device probing when resuming from hibernation
  - !16907  crypto: algif_hash - fix double free in hash_accept
  - net: tunnels: annotate lockless accesses to dev->needed_headroom
  - !16890  sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
  - !16889  scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
  - net: atlantic: fix aq_vec index out of range error
  - !16876  hulk-4.19-fix-CVE-2022-49989
  - nfs: handle failure of nfs_get_lock_context in unlock path
  - !16904  wifi: mac80211: Fix UAF in ieee80211_scan_rx()
  - !16888  drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
  - drm/amd/display: clear optc underflow before turn off odm clock
  - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
  - !16824  cifs: fix small mempool leak in SMB2_negotiate()
  - !16825  smb: client: Fix use-after-free in cifs_fill_dirent
  - crypto: algif_hash - fix double free in hash_accept
  - !16900  regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
  - wifi: mac80211: Fix UAF in ieee80211_scan_rx()
  - regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
  - !16869  vt: Clear selection before changing the font
  - !16873  mtd: maps: Fix refcount leak in ap_flash_init
  - !16871  ALSA: bcd2000: Fix a UAF bug on the error path of probing
  - !16878  wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
  - !16867  drivers:md:fix a potential use-after-free bug
  - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed
  - scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
  - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
  - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
  - xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
  - xen/privcmd: Corrected error handling path
  - mtd: maps: Fix refcount leak in ap_flash_init
  - ALSA: bcd2000: Fix a UAF bug on the error path of probing
  - vt: Clear selection before changing the font
  - drivers:md:fix a potential use-after-free bug
  - smb: client: Reset all search buffer pointers when releasing buffer
  - smb: client: Fix use-after-free in cifs_fill_dirent
  - cifs: fix small mempool leak in SMB2_negotiate()
  - ipvs: fix WARNING in __ip_vs_cleanup_batch()
  - net: sched: Fix use after free in red_enqueue()


author: chenyi <chenyi211@huawei.com> - 4.19.90-2507.3.0.0336
changelog:
  - !17108  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17113  Bluetooth: btrtl: Prevent potential NULL dereference
  - Bluetooth: btrtl: Prevent potential NULL dereference
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17057  media: cxusb: no longer judge rbuf when the write fails
  - !17073  Revert "dm-bufio: don't schedule in atomic context"
  - Revert "dm-bufio: don't schedule in atomic context"
  - !17046 v2  net: Fix CVE-2025-38000
  - media: cxusb: no longer judge rbuf when the write fails
  - sch_cbq: make cbq_qlen_notify() idempotent
  - net/sched: Always pass notifications when child class becomes empty
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  - sch_qfq: make qfq_qlen_notify() idempotent
  - sch_hfsc: make hfsc_qlen_notify() idempotent
  - sch_drr: make drr_qlen_notify() idempotent


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2507.4.0.0337
changelog:
  - !17221  net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - !17147  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2507.5.0.0338
changelog:
  - !17008  perf: Fix sample vs do_exit()
  - !17313  usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - !17302  fs/writeback: bail out if there is no more inodes for IO and queued once
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - fs/writeback: bail out if there is no more inodes for IO and queued once
  - !17097  smb: client: fix use-after-free in cifs_oplock_break
  - !17129  ipc: fix to protect IPCS lookups using RCU
  - !17130  fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  - !17263  mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  - ipc: fix to protect IPCS lookups using RCU
  - smb: client: fix use-after-free in cifs_oplock_break
  - perf: Fix sample vs do_exit()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2508.1.0.0339
changelog:
  - !17509 v2  ext4: add bounds checking in get_max_inline_xattr_value_size()
  - ext4: add bounds checking in get_max_inline_xattr_value_size()
  - !17482  mm: Fix possible deadlock in console_trylock_spinning
  - mm: Fix possible deadlock in console_trylock_spinning
  - !17456  md/raid1: Fix stack memory use after return in raid1_reshape
  - !17460 v2  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - !17448  vsock/vmci: Clear the vmci transport packet properly when initializing it
  - net: vlan: Fix kabi breakage of struct vlan_info
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - md/raid1: Fix stack memory use after return in raid1_reshape
  - !17397  Squashfs: check return result of sb_min_blocksize
  - vsock/vmci: Clear the vmci transport packet properly when initializing it
  - !17314  ovl: fix general protection fault in security_inode_getattr
  - !17420  bcache: fix NULL pointer in cache_set_flush()
  - !17431  ACPICA: Refuse to evaluate a method if arguments are missing
  - !17409  usb: net: sierra: check for no status endpoint
  - !17426 EDAC/amd64: Fix the calculation of umc base for Hygon family 18h model 4h
  - !17392  atm: clip: Fix infinite recursive call of clip_push().
  - ACPICA: Refuse to evaluate a method if arguments are missing
  - EDAC/amd64: Fix the calculation of umc base for Hygon family 18h model 4h
  - bcache: fix NULL pointer in cache_set_flush()
  - usb: net: sierra: check for no status endpoint
  - Squashfs: check return result of sb_min_blocksize
  - !17040  net: ch9200: fix uninitialised access during mii_nway_restart
  - atm: clip: Fix infinite recursive call of clip_push().
  - !17348  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - !17369  ext4: inline: fix len overflow in ext4_prepare_inline_data
  - !17220  Fix the race of lock/unlock and open for nfs
  - ext4: inline: fix len overflow in ext4_prepare_inline_data
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - ovl: fix general protection fault in security_inode_getattr
  - nfs: do not unlock when no lock is held
  - nfs: fix the race of lock/unlock and open
  - net: ch9200: fix uninitialised access during mii_nway_restart


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2508.2.0.0340
changelog:
  - !17478 EDAC/amd64: Do not warn when removing instances
  - EDAC/amd64: Do not warn when removing instances
  - !17552 [openEuler-1.0-LTS] Revert "scsi: hisi_sas: fix a issue related to timer of internal IO and SMP IO"
  - !17535  net/sched: sch_qfq: Fix CVE-2025-38477
  - Revert "scsi: hisi_sas: fix a issue related to timer of internal IO and SMP IO"
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2508.3.0.0341
changelog:
  - !17764  mm/smaps: fix race between smaps_hugetlb_range and migration
  - mm/smaps: fix race between smaps_hugetlb_range and migration
  - !17736 v2  mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17684  HID: core: do not bypass hid_hw_raw_request
  - mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17732  CVE-2025-38180
  - net: atm: fix /proc/net/atm/lec handling
  - net: atm: add lec_mutex
  - !17607  drm/sched: Increment job count before swapping tail spsc queue
  - HID: core: do not bypass hid_hw_raw_request
  - drm/sched: Increment job count before swapping tail spsc queue
  - !17562  sched: Fix sched tunable parameter range overflow
  - sched: Fix sched tunable parameter range overflow


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.1.0.0342
changelog:
  - !17822  iwlwifi: Add missing check for alloc_ordered_workqueue
  - !17814  crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  - !17819  jbd2: prevent softlockup in jbd2_log_do_checkpoint()
  - !17829  ipv6: reject malicious packets in ipv6_gso_segment()
  - !17827  net/packet: fix a race in packet_set_ring() and packet_notifier()
  - !17828  vsock: Do not allow binding to VMADDR_PORT_ANY
  - ipv6: reject malicious packets in ipv6_gso_segment()
  - vsock: Do not allow binding to VMADDR_PORT_ANY
  - net/packet: fix a race in packet_set_ring() and packet_notifier()
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
  - !17812  net: bridge: fix soft lockup in br_multicast_query_expired()
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  - net: bridge: fix soft lockup in br_multicast_query_expired()
  - !17528  clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
  - !17761  Fix oob when trace_get_user failed
  - tracing: Limit access to parser->buffer when trace_get_user failed
  - tracing: Remove unneeded goto out logic
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.4.0.0343
changelog:
  - !17935  ftrace: Also allocate and copy hash for reading of filter files
  - ftrace: Also allocate and copy hash for reading of filter files
  - !17920  x86/smp: ignore reboot IPI when stopping_cpu contains value
  - x86/smp: ignore reboot IPI when stopping_cpu contains value
  - !17905 [openEuler-1.0-LTS] perf/zhaoxin/uncore: Enhance uncore support and fix related
  - perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !17891  wifi: mac80211: reject TDLS operations when station is not associated
  - !17873  blk-cgroup: Use cond_resched() when destroy blkgs
  - wifi: mac80211: reject TDLS operations when station is not associated
  - !17878  Fix CVE-2025-38498
  - !17843  NFSv4: Fail mounts if the lease setup times out
  - use uniform permission checks for all mount propagation changes
  - do_change_type(): refuse to operate on unmounted/not ours mounts
  - blk-cgroup: Use cond_resched() when destroy blkgs
  - NFSv4: Fail mounts if the lease setup times out


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.5.0.0344
changelog:
  - !8566 [openEuler-1.0-LTS] Update a series of xhci-related Zhaoxin patches
  - !18002  gfs2: Validate i_depth for exhash directories
  - !17998  fix CVE-2025-38449
  - gfs2: Validate i_depth for exhash directories
  - drm: fix kabi for struct drm_framebuffer
  - drm/gem: Acquire references on GEM handles for framebuffers
  - drm/print: introduce new struct drm_device based WARN* macros
  - xhci: Add ZHAOXIN xHCI host U1/U2 feature support
  - Revert "xhci: Add Zhaoxin xHCI LPM U1/U2 feature support"
  - xhci: Show ZHAOXIN xHCI root hub speed correctly
  - Revert "xhci: Show Zhaoxin XHCI root hub speed correctly"
  - Revert "xhci: Fix a logic issue when display Zhaoxin XHCI root hub speed"
  - xhci: Fix TRB prefetch issue of ZHAOXIN hosts
  - Revert "xhci: fix issue of cross page boundary in TRB prefetch"
  - xhci: Fix resume issue of some ZHAOXIN hosts
  - Revert "xhci: fix issue with resume from system Sx state"


author: zhouyihang <zhouyihang3@h-partners.com> - 7.71.1-34
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:dynbuf: provide curlx_ names for reuse by the curl tool
         curl: use curlx_dynbuf for realloc when loading config files
         curl: make file2string use dynbuf
         paramhlp: fix CRLF-stripping files with "-d @file"
         libssh2: set length to 0 if strdup failed
         openldap: create ldap URLs correctly for IPv6 addresses
         multi: avoid memory-leak risk
         tool_cb_rea: limit rate unpause for -T . uploads
         tool_cfgable: free {proxy_}cipher13_list on exit


author: zhouyihang <zhouyihang3@h-partners.com> - 7.71.1-38
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:multi: check that the multi handle is valid in curl_multi_assign


author: xingwei <xingwei14@h-partners.com> - 7.71.1-41
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:altsvc: avoid integer overflow in expire calculation
         test391: verify --path-as-is with redirect
         urlapi: fix redirect to a new fragment or query (only)


author: xinghe <xinghe2@h-partners.com> - 7.71.1-42
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:curl_path: bring back support for SFTP path ending in /~
         curl_path: make SFTP handle a path like /~ properly


author: yaoxin <yao_xin001@hoperun.com> - 1.16.2-7
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47613,CVE-2024-47775,CVE-2024-47776
    CVE-2024-47777,CVE-2024-47778,CVE-2024-47774,CVE-2024-47540
    CVE-2024-47602,CVE-2024-47601,CVE-2024-47834,CVE-2024-47537
    CVE-2024-47597,CVE-2024-47543,CVE-2024-47596,CVE-2024-47539
    CVE-2024-47546


author: renmingshuai <renmingshuai@huawei.com> - 0.9.4-9
changelog:
  - Type:CVE
  - Id:CVE-2023-6004,CVE-2023-48795,CVE-2023-6918
  - SUG:NA
  - DESC:fix CVE-2023-6004,CVE-2023-48795 and CVE-2023-6918


author: gaihuiying <eaglegai@163.com> - 0.9.4-11
changelog:
  - Type:CVE
  - CVE:CVE-2025-4877 CVE-2025-4878 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877 CVE-2025-4878 CVE-2025-5372


author: GuoCe <guoce@kylinos.cn> - 3.7.9-37
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Modify the spec file to synchronize the version information of
         CHANGLOG and VERSION.


author: GuoCe <guoce@kylinos.cn> - 3.7.9-39
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: add loongarch64 support and disable valgrind-devel for loongarch64


author: wangshuo <wangshuo@kylinos.cn> - 3.7.9-40
changelog:
  - Type:CVE
  - CVE:CVE-2007-4559
  - SUG:NA
  - DESC:Patch9007-9008, fix CVE-2007-4559
  -      Patch9009, fix test_xml_etree error with expat versions that fix CVE-2023-52425


author: wangshuo <wangshuo@kylinos.cn> - 3.7.9-41
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport upstream patches
  -      gh-104049: do not expose on-disk location from SimpleHTTPRequestHandler
  -      gh-99889: Fix directory traversal security flaw in uu.decode()


author: wangshuo <wangshuo@kylinos.cn> - 3.7.9-43
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
  -      gh-124651: Quote template strings in `venv` activation scripts


