# changelog

author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-279.0.0.181
changelog:
  - !17745  trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17726  perf/core: Don't leak AUX buffer refcount on allocation failure
  - !17675  ftrace: Also allocate and copy hash for reading of filter files
  - !17670  ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - !15618  partitions: mac: fix handling of bogus partition table
  - trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17723  mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17727  CVE-2025-38465
  - !17454  md/raid1: Fix stack memory use after return in raid1_reshape
  - !17452  blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx
  - netlink: avoid infinite retry looping in netlink_unicast()
  - netlink: make sure we allow at least one dump skb
  - netlink: Fix rmem check in netlink_broadcast_deliver().
  - netlink: Fix wraparounds of sk->sk_rmem_alloc.
  - perf/core: Don't leak AUX buffer refcount on allocation failure
  - mm/dpool: mark dpool hugetlb page as dirty in free_huge_page()
  - !17631  perf/core: Exit early on perf_mmap() fail
  - ftrace: Also allocate and copy hash for reading of filter files
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - !17603  two bugfix for arm64 support HVO
  - !17657  selftests/bpf: Add remaining ASSERT_xxx() variants
  - selftests/bpf: Add remaining ASSERT_xxx() variants
  - !17614  xfrm: state: fix out-of-bounds read during lookup
  - !17626  Fix CVE-2025-37780
  - !17627  Fix CVE-2024-58069
  - !17624  rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - !17623  net_sched: hfsc: Fix a UAF vulnerability in class handling
  - !17622  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - !17621  CVE-2025-38052
  - !17619  tipc: Fix use-after-free in tipc_conn_close().
  - !17620  net: clear the dst when changing skb protocol
  - !17618  net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - !17617  net: fix udp gso skb_segment after pull from frag_list
  - !17616  atm: Fix NULL pointer dereference
  - !17615  udp: Fix memory accounting leak.
  - !17613  macsec: fix UAF bug for real_dev
  - !17612  vfio/pci: Properly hide first-in-list PCIe extended capability
  - perf/core: Exit early on perf_mmap() fail
  - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
  - isofs: Prevent the use of too small fid
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - net_sched: hfsc: Fix a UAF vulnerability in class handling
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - net: tipc: fix refcount warning in tipc_aead_encrypt
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
  - net: clear the dst when changing skb protocol
  - tipc: Fix use-after-free in tipc_conn_close().
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - net: fix udp gso skb_segment after pull from frag_list
  - atm: Fix NULL pointer dereference
  - udp: Fix memory accounting leak.
  - xfrm: state: fix out-of-bounds read during lookup
  - macsec: fix UAF bug for real_dev
  - vfio/pci: Properly hide first-in-list PCIe extended capability
  - !17376 net_sched: Flush gso_skb list too during ->change()
  - !17576  net/sched: Fix CVE-2025-37890
  - arm64: mm: HVO: fix deadlock in split vmemmap pmd
  - mm: HVO: fix hard lockup in split_vmemmap_huge_pmd under x86
  - !17581  tracing: Add down_write(trace_event_sem) when adding trace event
  - !17580  iio: adc: ti-ads8688: fix information leak in triggered buffer
  - tracing: Add down_write(trace_event_sem) when adding trace event
  - !17579 v2  two cve fix
  - iio: adc: ti-ads8688: fix information leak in triggered buffer
  - vfio/platform: check the bounds of read/write syscalls
  - powerpc/mm/fault: Fix kfence page fault reporting
  - net/sched: ets: use old 'nbands' while purging unused classes
  - net/sched: Always pass notifications when child class becomes empty
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
  - md/raid1: Fix stack memory use after return in raid1_reshape
  - blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx
  - net_sched: Flush gso_skb list too during ->change()
  - partitions: mac: fix handling of bogus partition table


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-280.0.0.182
changelog:
  - !17849 [OLK-5.10]:update patches for sw64 architecture
  - !17852  cpufreq: Init policy->rwsem before it may be possibly used
  - sw64: fix for userspace asking for syscall(-1)
  - sw64: update junzhang default config file
  - sw64: kvm: introduce pmd_thp_or_huge for PMD hugepage checking
  - sw64: add cross-page check in software unaligned write handling
  - sw64: ptrace: fail system calls on invalid address access in PEEKUSR
  - sw64: ptrace: fix a bug in return value handling in PEEKUSR AND POKEUSR
  - !17738  CVE-2024-53216 && CVE-2024-56558
  - cpufreq: Init policy->rwsem before it may be possibly used
  - !17801  page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - !17799  iwlwifi: Add missing check for alloc_ordered_workqueue
  - !17817  vmci: Prevent the dispatching of uninitialized payloads
  - !17680 Add Model specific EPP adjustment support for EMR/SPR/GNR
  - !17667 cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
  - !17682 Add TPMI RAPL PMU support for GNR/CWF and later Intel Xeon machines
  - !17664 intel_pstate support OOB mode for EMR/GNR/SRF/CWF
  - !17662 platform/x86: ISST: Add Clearwater Forest to support list
  - !17820  mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - !17767 RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - !17806  pinmux: fix race causing mux_owner NULL with active mux_usecount
  - !17805  f2fs: fix to avoid out-of-boundary access in devs.path
  - vmci: Prevent the dispatching of uninitialized payloads
  - pinmux: fix race causing mux_owner NULL with active mux_usecount
  - f2fs: fix to avoid out-of-boundary access in devs.path
  - !17795  perf/core: Prevent VMA split of buffer mappings
  - !17316 [OLK-5.10] backport the follow important bugfix for nvme driver from upstream linux-5.10.y
  - !17791  ipv6: mcast: extend RCU protection in igmp6_send()
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - page_pool: fix inconsistency for page_pool_ring_[un]lock()
  - net: page_pool: use in_softirq() instead
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - !17573 ROH: Add crc_err_cnt and retry_cnt mib statistics
  - perf/core: Prevent VMA split of buffer mappings
  - !17773  thunderbolt: Do not double dequeue a configuration request
  - !17793 v2  fix some CVEs
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable
  - rapidio: fix an API misues when rio_add_net() fails
  - filemap: avoid truncating 64-bit offset to 32 bits
  - drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
  - drm/amd/display: Fix memory leak
  - scsi: ufs: bsg: Set bsg_queue to NULL after removal
  - ipv6: mcast: extend RCU protection in igmp6_send()
  - !17759  CVE-2025-37834
  - !17749  mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
  - !17688  netfilter: fix CVE-2022-49622
  - !17698  netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - !17686  net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
  - !17710  bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - !17765  mm/smaps: fix race between smaps_hugetlb_range and migration
  - !17740  Fix trace may OOB when trace_get_user failed
  - !17743  i2c: qup: jump out of the loop in case of timeout
  - thunderbolt: Do not double dequeue a configuration request
  - RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - mm/smaps: fix race between smaps_hugetlb_range and migration
  - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
  - mm/vmscan: don't try to reclaim hwpoison folio
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
  - i2c: qup: jump out of the loop in case of timeout
  - tracing: Limit access to parser->buffer when trace_get_user failed
  - tracing: Remove unneeded goto out logic
  - nfsd: fix UAF when access ex_uuid or ex_stats
  - SUNRPC: no need get cache ref when protected by rcu
  - nfsd: no need get cache ref when protected by rcu
  - SUNRPC: introduce cache_check_rcu to help check in rcu context
  - nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
  - nfsd: release svc_expkey/svc_export with rcu_work
  - SUNRPC: make sure cache entry active before cache_show
  - nfsd: make sure exp active before svc_export_show
  - platform/x86: ISST: Add Clearwater Forest to support list
  - powercap: intel_rapl_tpmi: Enable PMU support
  - powercap: intel_rapl: Introduce APIs for PMU support
  - powercap: intel_rapl: Sort header files
  - cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
  - cpufreq: intel_pstate: Update Balance-performance EPP for Granite Rapids
  - cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids
  - cpufreq: intel_pstate: Allow model specific EPPs
  - bitfield: add FIELD_PREP_CONST()
  - cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids
  - cpufreq: intel_pstate: Update EPP for AlderLake mobile
  - cpufreq: intel_pstate: Support Clearwater Forest OOB mode
  - cpufreq: intel_pstate: Support Granite Rapids and Sierra Forest OOB mode
  - cpufreq: intel_pstate: Support Emerald Rapids OOB mode
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - selftests: netfilter: add test case for nf trace infrastructure
  - netfilter: nf_tables: fix crash when nf_trace is enabled
  - netfilter: nf_tables: avoid skb access on nf_stolen
  - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
  - ROH: Add crc_err_cnt and retry_cnt mib statistics
  - nvme-tcp: fix premature queue removal and I/O failover


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-281.0.0.183
changelog:
  - !17933  CVE-2025-38502
  - bpf: Fix updating attached freplace prog in prog_array map
  - bpf: Resolve fext program type when checking map compatibility
  - Fix kabi breakage for bpf_map by using KABI_FILL_HOLE and KABI_EXTEND
  - bpf: Fix oob access in cgroup local storage
  - bpf: Move cgroup iterator helpers to bpf.h
  - bpf: Move bpf map owner out of common struct
  - bpf: Add cookie object to bpf maps
  - bpf: generalise tail call map compatibility check
  - !17904 [OLK-5.5] perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !16636 [OLK-5.10] dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - !17912  net/mlx5: Check device memory pointer before usage
  - net/mlx5: Check device memory pointer before usage
  - !17885 [OLK-5.10] backport important bugfix for lpfc driver from upstream linux-5.10.y
  - perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !17867  scsi: core: ufs: Fix a hang in the error handler
  - scsi: lpfc: Fix link down processing to address NULL pointer dereference
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
  - !17443  scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
  - scsi: core: ufs: Fix a hang in the error handler
  - dma: phyitum: enable CONFIG_PHYTIUM_ERRATUM_FT3386
  - dma: pswiotlb: Move platform-identification to cpu errata
  - dma: pswiotlb: Move pswiotlb dma functions behind dma_map_ops
  - dma: Fix kabi breakage due to "dma: phytium: Add PSWIOTLB mechanism to improve DMA performance"
  - dma: phyitum: enable CONFIG_PSWIOTLB
  - dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-282.0.0.184
changelog:
  - !17999  gfs2: Validate i_depth for exhash directories
  - !17970  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  - gfs2: Validate i_depth for exhash directories
  - !17995  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()


author: Li Nan <linan122@huawei.com> - 5.10.0-283.0.0.185
changelog:
  - !18068  net: bridge: fix soft lockup in br_multicast_query_expired()
  - !18025  trace/fgraph: Fix error handling
  - !18100  Fix CVE-2022-50255
  - !18102  bpf: Fix memleak due to fentry attach failure
  - bpf: Fix memleak due to fentry attach failure
  - tracing: Have the user copy of synthetic event address use correct context
  - tracing: Fix reading strings from synthetic events
  - tracing: Move duplicate code of trace_kprobe/eprobe.c into header
  - net: bridge: fix soft lockup in br_multicast_query_expired()
  - trace/fgraph: Fix error handling


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-284.0.0.186
changelog:
  - !18283 RDMA/hns: Fix wrong WQE data when QP wraps around
  - !18262  net: dsa: Avoid cross-chip syncing of VLAN filtering
  - !17990 perf: backport community patches
  - !18229  net: ch9200: fix uninitialised access during mii_nway_restart
  - RDMA/hns: Fix wrong WQE data when QP wraps around
  - net: dsa: Avoid cross-chip syncing of VLAN filtering
  - !18251  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - !18162  x86/MCE: Always save CS register on AMD Zen IF Poison errors
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - net: ch9200: fix uninitialised access during mii_nway_restart
  - perf: Always feature test reallocarray
  - perf comm str: Avoid sort during insert
  - perf comm: Fix comm_str__put() for reference count checking
  - perf comm: Add reference count checking to 'struct comm_str'
  - libperf rc_check: Make implicit enabling work for GCC
  - libperf rc_check: Enable implicitly with sanitizers
  - libperf: Add reference count checking macros
  - !18122  nfsd: call op_release, even when op_func returns an error
  - !18126  scsi: target: iscsi: Fix a race condition between login_work and the login thread
  - !17610 net: ravb: Fix missing rtnl lock in suspend/resume path
  - !17876 fs/ntfs3: cancle set bad inode after removing name fails
  - !17927 spufs: fix a leak on spufs_new_file() failure
  - !17929 bus: fsl-mc: fix double-free on mc_dev
  - !18138  VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  - !18155  ARM: rockchip: fix kernel hang during smp initialization
  - x86/MCE: Always save CS register on AMD Zen IF Poison errors
  - ARM: rockchip: fix kernel hang during smp initialization
  - !18112  tee: fix NULL pointer dereference in tee_shm_put
  - !18070  fs: writeback: fix use-after-free in __mark_inode_dirty()
  - !18099  nfsd: replace wait_on_bit by wait_on_bit_acquire in nfsd_file_acquire
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  - scsi: target: iscsi: Fix a race condition between login_work and the login thread
  - nfsd: call op_release, even when op_func returns an error
  - tee: fix NULL pointer dereference in tee_shm_put
  - nfsd: replace wait_on_bit by wait_on_bit_acquire in nfsd_file_acquire
  - fs: writeback: fix use-after-free in __mark_inode_dirty()
  - bus: fsl-mc: fix double-free on mc_dev
  - spufs: fix a leak on spufs_new_file() failure
  - fs/ntfs3: cancle set bad inode after removing name fails
  - net: ravb: Fix missing rtnl lock in suspend/resume path


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-285.0.0.187
changelog:
  - !18305  vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
  - !18278  sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - !18067  NFSD: Protect against send buffer overflow in NFSv2 READ
  - !18335  x86/paravirt: Fix build due to __text_gen_insn() backport
  - !18043 [OLK-5.10] Add SEV-ES hypervisor support
  - x86/paravirt: Fix build due to __text_gen_insn() backport
  - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
  - !18052  fix oenetcls bugs
  - sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - KVM: SVM: Add Hygon CSV2 detection for confidential computing support
  - KVM: x86: Revert "KVM: x86: Mark GPRs dirty when written"
  - KVM: SVM: Unconditionally sync GPRs to GHCB on VMRUN of SEV-ES guest
  - KVM: SVM: Add support for booting APs in an SEV-ES guest
  - KVM: SVM: fix 32-bit compilation
  - KVM: SVM: Add AP_JUMP_TABLE support in prep for AP booting
  - KVM: SVM: Provide support to launch and run an SEV-ES guest
  - KVM: SVM: Provide an updated VMRUN invocation for SEV-ES guests
  - KVM: SVM: Provide support for SEV-ES vCPU loading
  - KVM: SVM: Provide support for SEV-ES vCPU creation/loading
  - KVM: SVM: Update ASID allocation to support SEV-ES guests
  - KVM: SVM: Set the encryption mask for the SVM host save area
  - KVM: SVM: Add NMI support for an SEV-ES guest
  - KVM: SVM: Guest FPU state save/restore not needed for SEV-ES guest
  - KVM: SVM: Do not report support for SMM for an SEV-ES guest
  - KVM: x86: Update __get_sregs() / __set_sregs() to support SEV-ES
  - KVM: SVM: Add support for CR8 write traps for an SEV-ES guest
  - KVM: SVM: Add support for CR4 write traps for an SEV-ES guest
  - KVM: SVM: Add support for CR0 write traps for an SEV-ES guest
  - KVM: SVM: Add support for EFER write traps for an SEV-ES guest
  - KVM: SVM: Support string IO operations for an SEV-ES guest
  - KVM: SVM: Support MMIO for an SEV-ES guest
  - KVM: SVM: Create trace events for VMGEXIT MSR protocol processing
  - KVM: SVM: Create trace events for VMGEXIT processing
  - KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x100
  - KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x004
  - KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x002
  - KVM: SVM: Add initial support for a VMGEXIT VMEXIT
  - KVM: SVM: Prepare for SEV-ES exit handling in the sev.c file
  - KVM: SVM: Cannot re-initialize the VMCB after shutdown with SEV-ES
  - KVM: SVM: Do not allow instruction emulation under SEV-ES
  - KVM: SVM: Prevent debugging under SEV-ES
  - KVM: SVM: Add required changes to support intercepts under SEV-ES
  - KVM: x86: introduce complete_emulated_msr callback
  - KVM: x86: use kvm_complete_insn_gp in emulating RDMSR/WRMSR
  - KVM: x86: remove bogus #GP injection
  - KVM: x86: Mark GPRs dirty when written
  - KVM: SVM: Add support for the SEV-ES VMSA
  - KVM: SVM: Add GHCB accessor functions for retrieving fields
  - KVM: SVM: Add support for SEV-ES capability in KVM
  - NFSD: Protect against send buffer overflow in NFSv2 READ
  - net/oenetcls: use workqueue for ntuple cfg
  - net/oenetcls: remove oenetcls trace hook
  - net/oenetcls: use raw_smp_processor_id() instead of smp_processor_id()
  - net/oenetcls: Fix oecls_numa_info_table memleak


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-286.0.0.188
changelog:
  - !18480  KVM: arm64: vgic-v4: Restore pending state on host userspace write
  - KVM: arm64: vgic-v4: Restore pending state on host userspace write
  - !18463 scsi/hifc: Fix rport dev loss tmo flag and function parameter check err
  - !18150  CVE-2022-50306
  - !18314  fs: quota: create dedicated workqueue for quota_release_work
  - !17400  fscrypt: Don't use problematic non-inline crypto engines
  - scsi/hifc: Fix rport dev loss tmo flag and function parameter check err
  - !15216  Fix kfree mismatch reported by cocci
  - !18424  net/hinic3: Modify driver version
  - net/hinic3: Modify driver version
  - !18202  blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none
  - !18200  block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
  - !18197 v2  loop: Avoid updating block size under exclusive owner
  - !18007  scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
  - !17991  CVE-2025-39697
  - !18361  umount performance fix
  - !18353  net/oenetcls: Fix memleak when clean flow table
  - do_make_slave(): choose new master sanely
  - change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED()
  - change_mnt_propagation() cleanups, step 1
  - net/oenetcls: Fix memleak when clean flow table
  - fs: quota: create dedicated workqueue for quota_release_work
  - blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none
  - block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
  - loop: Avoid updating block size under exclusive owner
  - ext4: use ext4_fc_tl_mem in fast-commit replay path
  - ext4: fix potential out of bound read in ext4_fc_replay_scan()
  - ext4: factor out ext4_fc_get_tl()
  - ext4: introduce EXT4_FC_TAG_BASE_LEN helper
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
  - NFS: Fix a race when updating an existing write
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
  - fscrypt: Don't use problematic non-inline crypto engines
  - Fix kfree mismatch reported by cocci


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-287.0.0.189
changelog:
  - !18584  hisi: l0: update device name from hisi_l0 to hisi_soc_cache_mgmt
  - !18537  posix-timers: Ensure timer ID search-loop limit is valid
  - hisi: l0: update device name from hisi_l0 to hisi_soc_cache_mgmt
  - !18549  i40e: fix idx validation in config queues msg
  - i40e: fix idx validation in config queues msg
  - !18534 [OLK-5.10]:update patches for sw64 architecture
  - !18530 drivers:misc:sdma-dae: optimize kernel code
  - posix-timers: Ensure timer ID search-loop limit is valid
  - drivers:misc:sdma-dae: optimize kernel code
  - sw64: fix the condition for enabling hw_una_enabled
  - sw64: add trap related macros
  - sw64: add missing memory clobbers
  - sw64: optimize ipi handling
  - sw64: Add inline find_next_set/and/clear_bit()
  - sw64: optimize asid clearation
  - sw64: update cflags for new compiler
  - sw64: enable -relax when CONFIG_FUNCTION_TRACER=y
  - sw64: efi: fix compile error when CONFIG_EFI=n
  - sw64: powercap: fix misuse of an uninitialized temporary variable
  - sw64: powercap: increase the interval of polling mode
  - sw64: powercap: fix Kconfig dependency for SW64_POWERCAP
  - sw64: powercap: avoid checking meaningless target freq
  - sw64: irqchip: update effective affinity for INTx
  - sw64: msi: fix affinity change of managed irq
  - sw64: use orig_r0 as syscall nr
  - sw64: revert ioremap() to __va() in ioport_map()
  - sw64: fix unresolved reference error when close pci
  - sw64: kvm: add the C4 kvm_regs structure to uapi kvm.h
  - !18487 RDMA/hns: Fix more wrong WQE data cases when QP wraps around
  - !18514  tracing: probes: Fix a possible race in trace_probe_log APIs
  - tracing: probes: Fix a possible race in trace_probe_log APIs
  - !18512  iio: adc: at91: call input_free_device() on allocated iio_dev
  - iio: adc: at91: call input_free_device() on allocated iio_dev
  - !18490 v2  Add some bugfix for l0.
  - hisi: l0: fix security risks for l0
  - hisi: l3t: use readl_poll_timeout_atomic to wait reg op finish
  - hisi: l3t: fix l3t unlock order
  - hisi: l3t: fix conflict between HISI050 and HISI021
  - !18397  scsi: target: target_core_configfs: Add length check to avoid buffer overflow
  - !18470  e1000e: fix heap overflow in e1000_set_eeprom
  - RDMA/hns: Fix more wrong WQE data cases when QP wraps around
  - e1000e: fix heap overflow in e1000_set_eeprom
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-288.0.0.190
changelog:
  - !18738  fs: udf: fix OOB read in lengthAllocDescs handling
  - !2934 e1000e: Add support for the next LOM generation
  - !18783  padata: Reset next CPU when reorder sequence wraps around
  - !18737 [OLK-5.10] backport important bugfix for mpt3sas driver from upstream linux-5.10.y
  - !18743 [OLK-5.10] backport important bugfix for lpfc driver from upstream linux-5.10.y
  - padata: Reset next CPU when reorder sequence wraps around
  - !18722  dm array: fix releasing a faulty array block twice in dm_array_cursor_end
  - !14672 IXIC:add phytium ixic d2000 driver
  - !18729  perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
  - !18728  *** CVE-2025-39973 ***
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path
  - fs: udf: fix OOB read in lengthAllocDescs handling
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
  - i40e: add validation for ring_len param
  - i40e: increase max descriptors for XL710
  - !13242 [OLK-5.10] openeuler_defconfig: clean up invalid kernel configurations
  - dm array: fix releasing a faulty array block twice in dm_array_cursor_end
  - !18687 v2  net/oenetcls: Balancing softirq to improve performance
  - !18686  tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
  - !18018 Rate-limit the logging of dirty-page and SPECTRE_V2 messages
  - !18378 sched/fair: remove qos_reweight logic under non-SMP scenario
  - net/oenetcls: Balancing softirq to improve performance
  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
  - !18663  perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg
  - !18628  tracing: dynevent: Add a missing lockdown check on dynevent
  - perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg
  - !18617  Fix CVE-2025-39993
  - tracing: dynevent: Add a missing lockdown check on dynevent
  - media: rc: fix races with imon_disconnect()
  - media: imon: grab lock earlier in imon_ir_change_protocol()
  - media: imon: Fix race getting ictx->lock
  - openeuler_defconfig: clean up invalid kernel configurations
  - sched/fair: remove qos_reweight logic under non-SMP scenario
  - Rate-limit the logging of dirty-page and SPECTRE_V2 messages
  - IXIC:add phytium ixic d2000 driver
  - IXIC:add phytium ixic d2000 DT binding docs
  - e1000e: Add support for the next LOM generation


author: xinsheng <xinsheng3@huawei.com> - 3.9.9-36
changelog:
  - Type:CVE
  - CVE:CVE-2024-11168
  - SUG:NA
  - DESC:fix CVE-2024-11168
         - Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format


author: lipengyu <lipengyu@kylinos.cn> - 3.9.9-41
changelog:
  - Type:CVE
  - CVE:CVE-2025-4517 CVE-2025-4138 CVE-2024-12718 CVE-2025-4330 CVE-2025-4435
  - SUG:NA
  - DESC:fix CVE-2025-4517 CVE-2025-4138 CVE-2024-12718 CVE-2025-4330 CVE-2025-4435


