# changelog

author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-300.0.0.203
changelog:
  - !20464  rcu: Protect ->defer_qs_iw_pending from data race
  - !20318 net: hns3: check pf tc cfg when setting vf tc
  - !20522  CVE-2022-50616
  - !20423  use SYS_CNTVCTSS_EL0 for gettimeofday
  - regulator: core: Fix resolve supply lookup issue
  - regulator: core: Use different devices for resource allocation and DT lookup
  - !20382 [OLK 5.10]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO.
  - !19965  nvme-fc: use lock accessing port_state and rport state
  - !20226  leapraid: supports LeapRaid controller
  - !20436  fix CVE-2026-22998
  - rcu: Protect ->defer_qs_iw_pending from data race
  - !20449  scsi/hiraid: Support New Raid feature
  - !20252  ntfs: set dummy blocksize to read boot_block when mounting
  - !19920 [OLK-5.10] Backport patches soc_cache for kunpeng soc
  - !20335  Fix CVE-2025-37947
  - mm: Add PAGE_ALIGN_DOWN macro
  - soc cache: fix walk page parameter and drop incorrect check
  - soc cache: Fix incorrect error path of ioctl
  - soc cache: Fix incorrect size validation
  - soc cache: Enforce maintain type check
  - soc cache: Modify default config to compile HiSilicon SoC cache driver
  - !19858 [OLK-5.10] perf support for HiSilicon HIP12
  - !20331 Fix CVE-2025-39835
  - !20439 Fix CVE-2025-39945
  - !20251 Fix CVE-2025-38480
  - !20184 Fix CVE-2025-37770
  - !20185 Fix CVE-2022-49829
  - !20183 Fix CVE-2025-23138
  - !20240 Fix CVE-2025-21981
  - !20409  net: xfrm: Fix CVE-2025-40215
  - !20408  net: xfrm: Fix CVE-2025-39797
  - !20407  netfilter: allow exp not to be removed in nf_ct_find_expectation
  - !20406  bpf, sockmap: Avoid using sk_socket after free when sending
  - !20405  can: bcm: add locking for bcm_op runtime updates
  - !20404  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - soc cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent
  - scsi/hiraid: Support New Raid feature
  - !19950 【OLK-5.10】 Drivers GPU Patches from 6.6
  - !20422  driver core: fix potential null-ptr-deref in device_add()
  - cnic: Fix use-after-free bugs in cnic_delete_task
  - !20421  arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - !20420  usb: early: xhci-dbc: Fix a potential out-of-bound memory access
  - !20418  drivers: base: Free devm resources when unregistering a device
  - !20417  driver core: fix resource leak in device_add()
  - !20416  Fix CVE-2022-49309
  - !20415  kernel/resource: fix kfree() of bootmem memory again
  - !20414  drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
  - !20413  of: check previous kernel's ima-kexec-buffer against memory bounds
  - !20412  HID: core: Harden s32ton() against conversion to 0 bits
  - !20411  iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  - nvmet-tcp: remove boilerplate code
  - !20390  drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
  - vdso: do cntvct workaround in the VDSO
  - arm64: vdso: remove two .altinstructions related symbols
  - arm64: vdso: use SYS_CNTVCTSS_EL0 for gettimeofday
  - arm64: alternative: patch alternatives in the vDSO
  - arm64: module: move find_section to header
  - driver core: fix potential null-ptr-deref in device_add()
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - usb: early: xhci-dbc: Fix a potential out-of-bound memory access
  - drivers: base: Free devm resources when unregistering a device
  - driver core: fix resource leak in device_add()
  - drivers: staging: rtl8723bs: Fix locking in rtw_scan_timeout_handler()
  - drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()
  - !20383  usb: cdns3: fix random warning message when driver load
  - kernel/resource: fix kfree() of bootmem memory again
  - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
  - of: check previous kernel's ima-kexec-buffer against memory bounds
  - HID: core: Harden s32ton() against conversion to 0 bits
  - !19959 【OLK-5.10】Support NMI Watchdog
  - iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
  - xfrm: delete x->tunnel as we delete x
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
  - xfrm: Duplicate SPI Handling
  - netfilter: allow exp not to be removed in nf_ct_find_expectation
  - bpf, sockmap: Avoid using sk_socket after free when sending
  - can: bcm: add locking for bcm_op runtime updates
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation.
  - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
  - arm64/watchdog_hld: Add a cpufreq notifier for update watchdog thresh
  - watchdog/perf: Provide function for adjusting the event period
  - config: enable CONFIG_ARM64_NMI and CONFIG_HARDLOCKUP_DETECTOR_PERF for arm64
  - irqchip/gic-v3: Fix one race condition due to NMI withdraw
  - watchdog: Fix call trace when failed to initialize sdei
  - watchdog: Support watchdog_sdei coexist with existing watchdogs
  - init: only move down lockup_detector_init() when sdei_watchdog is enabled
  - arm64: enable perf events based hard lockup detector
  - arm64: add hw_nmi_get_sample_period for preparation of lockup detector
  - usb: cdns3: fix random warning message when driver load
  - !20051  smb3: fix for slab out of bounds on mount to ksmbd
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - watch_queue: fix pipe accounting mismatch
  - drm/amd/pm/powerplay: Prevent division by zero
  - !20357  ext4: fix e4b bitmap inconsistency reports
  - ice: fix memory leak in aRFS after reset
  - drm/hisilicon/hibmc: hibmc-drm bugfix for DP
  - !19940 [OLK-5.10] Add workaround for HIP09/HIP10/HIP10C/HIP12 erratum 162100803/162200807/162400807/165010802 patches from 6.6
  - drm/hisilicon/hibmc:fix KVM is not displaying when GRUB VGA is on
  - drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local
  - drm/hisilicon/hibmc: fix HPD interrupts triggering the wrong behavior
  - drm/hisilicon/hibmc: Getting connector info and EDID by using AUX channel
  - drm/hisilicon/hibmc: Add vga connector detect functions
  - drm/hisilicon/hibmc: Add MSI irq getting and requesting for HPD
  - drm/hisilicon/hibmc: Enable this hot plug detect of irq feature
  - drm/hisilicon/hibmc: Add colorbar-cfg feature and its debugfs file
  - drm/hisilicon/hibmc: Refactor the member of drm_aux in struct hibmc_dp
  - drm/hisilicon/hibmc: Add dp serdes cfg in dp process
  - drm/hisilicon/hibmc: Add dp serdes cfg to adjust serdes rate, voltage and pre-emphasis
  - drm/hisilicon/hibmc: Restructuring the header dp_reg.h
  - drm/hisilicon/hibmc: select CONFIG_DRM_DISPLAY_DP_HELPER
  - drm: Call drm_atomic_helper_shutdown() at shutdown time for misc drivers
  - drm/ast: Implement polling for VGA and SIL164 connectors
  - drm/sysfs: Register "ddc" symlink later
  - drm/hisilicon/hibmc: add dp module in hibmc
  - drm/hisilicon/hibmc: refactored struct hibmc_drm_private
  - drm/hisilicon/hibmc: add dp hw moduel in hibmc driver
  - drm/hisilicon/hibmc: add dp link moduel in hibmc drivers
  - drm/hisilicon/hibmc: add dp aux in hibmc drivers
  - gic: increase the arch_timer priority to avoid hardlockup
  - openeuler_defconfig: Add CONFIG_HISILICON_ERRATUM_162100803
  - drm/scheduler: fix fence ref counting
  - !19855 [OLK-5.10] Backport patches of cpufreq features and kunpeng topology
  - ext4: fix e4b bitmap inconsistency reports
  - !20305 irqchip/gic-v3-its: Remove DevID Pool's restriction
  - !20256 Fix CVE-2025-39828
  - !20339  wifi: prevent A-MSDU attacks in mesh networks
  - wifi: prevent A-MSDU attacks in mesh networks
  - ksmbd: fix stream write failure
  - ksmbd: prevent out-of-bounds stream writes by validating *pos
  - xfs: do not propagate ENODATA disk errors into xattr code
  - net: hns3: check pf tc cfg when setting vf tc
  - net: hns3: support tc limit speed
  - net: hns3: the multi-tcs VF can be configured only when the interface is down
  - irqchip/gic-v3-its: Remove DevID Pool's restriction
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
  - perf iostat: Fix Segmentation fault from NULL 'struct perf_counts_values *'
  - perf: Update .gitignore file
  - perf stat: Enable iostat mode for x86 platforms
  - perf stat: Helper functions for PCIe root ports list in iostat mode
  - perf: Fix tt_core mismatch over PG CPU
  - perf iostat: Use system-wide mode if the target cpu_list is unspecified
  - perf arm_spe: Correct memory level for remote access
  - Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU
  - Documentation: hisi-pmu: Fix of minor format error
  - drivers/perf: hisi: Add support for L3C PMU v3
  - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
  - arm64: topology: Setup amu fie when cpu hotplugging
  - topology: Set capacity_freq_ref in all cases
  - arm64/amu: Use capacity_ref_freq() to set AMU ratio
  - cpufreq/cppc: Set the frequency used for computing the capacity
  - cpufreq/cppc: Move and rename cppc_cpufreq_{perf_to_khz|khz_to_perf}()
  - energy_model: Use a fixed reference frequency
  - cpufreq/schedutil: Use a fixed reference frequency
  - cpufreq: Use the fixed and coherent frequency for scaling capacity
  - sched/topology: Add a new arch_scale_freq_ref() method
  - arch_topology: Introduce thermal pressure update function
  - riscv: export cpu/freq invariant to scheduler
  - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()
  - cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()
  - cpufreq: Allow drivers to advertise boost enabled
  - cpufreq: ACPI: Remove unused variables 'acpi_cpufreq_online' and 'ret'
  - openeuler_defconfig: Enable CONFIG_ACPI_CPPC_CPUFREQ_FIE
  - cpufreq: CPPC: Fix build error without CONFIG_ACPI_CPPC_CPUFREQ_FIE
  - cpufreq: CPPC: Fix unused-function warning
  - cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
  - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
  - cpufreq: Initialize cpufreq-based invariance before subsys
  - cpufreq: ACPI: Mark boost policy as enabled when setting boost
  - cpufreq: ACPI: Only set boost MSRs on supported CPUs
  - cpufreq: ACPI: Defer setting boost MSRs
  - cpufreq: acpi: Remove acpi_cpufreq_cpu_ready()
  - cpufreq: Fix per-policy boost behavior on SoCs using cpufreq_boost_set_sw()
  - Documentation: power: Add description about new callback for EM registration
  - arch_topology: Avoid use-after-free for scale_freq_data
  - cpufreq: Exit governor when failed to start old governor
  - cpufreq: Move the check of cpufreq_driver->get into cpufreq_verify_current_freq()
  - cpufreq: Initialize cpufreq-based frequency-invariance later
  - cpufreq: Hold cpufreq_driver_lock when assigning cpufreq_driver->set_boost
  - cpufreq: Remove duplicate check in __cpufreq_offline()
  - cpufreq: Don't unregister cpufreq cooling on CPU hotplug
  - cpufreq: Remove the ->stop_cpu() driver callback
  - cpufreq: intel_pstate: Combine ->stop_cpu() and ->offline()
  - cpufreq: powernv: Migrate to ->exit() callback instead of ->stop_cpu()
  - docs/zh_CN: add cpu-freq cpu-drivers.rst translation
  - cpufreq: Contain scaling_cur_freq.attr in cpufreq_attrs
  - cpufreq: CPPC: Remove forward declaration of cppc_cpufreq_register_em()
  - cpufreq: CPPC: Do not return a value from populate_efficiency_class()
  - cpufreq: CPPC: Remove cpu_data_list
  - cpufreq: CPPC: Remove forward declaration of hisi_cppc_cpufreq_get_rate()
  - cpufreq: CPPC: Register EM based on efficiency class information
  - PM: EM: Change the order of arguments in the .active_power() callback
  - cpufreq: Add callback to register with energy model
  - PM: EM: Add .get_cost() callback
  - cpufreq: CPPC: Add per_cpu efficiency_class
  - cpufreq: remove useless INIT_LIST_HEAD()
  - ACPI: CPPC: Disable FIE if registers in PCC regions
  - ACPI: CPPC: Add emtpy stubs of functions for CONFIG_ACPI_CPPC_LIB unset
  - cpufreq: cppc: Fix invalid return value in hisi_cppc_cpufreq_get_rate()
  - cpufreq: cppc: Fix invalid return value in .get() callback
  - cppc_cpufreq: Fix possible null pointer dereference
  - cpufreq: CPPC: Fix error handling in cppc_scale_freq_workfn()
  - cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus
  - cpufreq: CPPC: Add support for frequency invariance
  - arch_topology: Export arch_freq_scale and helpers
  - cpufreq: CPPC: Pass structure instance by reference
  - cpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_init
  - cpufreq: CPPC: Migrate to ->exit() callback instead of ->stop_cpu()
  - cppc_cpufreq: replace per-cpu data array with a list
  - cppc_cpufreq: expose information on frequency domains
  - cppc_cpufreq: clarify support for coordination types
  - arch_topology: Allow multiple entities to provide sched_freq_tick() callback
  - sched/topology,schedutil: Wrap sched domains rebuild
  - arch_topology: Rename freq_scale as arch_freq_scale
  - arm64: topology: Drop the useless update to per-cpu cycles
  - arm64: topology: Make AMUs work with modular cpufreq drivers
  - arm64: topology: Reorder init_amu_fie() a bit
  - arm64: topology: Avoid the have_policy check
  - cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
  - cpufreq: prevent NULL dereference in cpufreq_online()
  - cpufreq: CPPC: Fix wrong max_freq in policy initialization
  - cppc_cpufreq: simplify use of performance capabilities
  - cpufreq: Introduce a more generic way to set default per-policy boost flag
  - cpufreq: Fix re-boost issue after hotplugging a CPU
  - cpufreq: Support per-policy performance boost
  - ntfs: set dummy blocksize to read boot_block when mounting
  - leapraid: supports LeapRaid controller
  - perf mem: Count L2 HITM for c2c statistic
  - perf mem: Add statistics for peer snooping
  - perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
  - tools headers UAPI: Sync include/uapi/linux/perf_event.h header with the kernel
  - perf arm-spe: augment the data source type with neoverse_spe list
  - tools arm64: Import cputype.h
  - arm64: cputype: Add cputype definition for HIP12
  - drivers/perf: hisi: Add events and rename event "cycle" for pa_pmu
  - drivers/perf: hisi: Fixes the incorrect bitmask limit for the CPA event sysfs interface
  - drivers/perf: hisi: Add cacheable option for L3C PMU
  - perf: Remove unstable events for uncore L3C PMU
  - drivers/perf: hisi: Clarifying event names and fix event ID for pa_pmu
  - perf iostat: hisi: Fix port range retrival
  - drivers/perf: hisi: Add support for L3C PMU v3
  - drivers/perf: hisi: Refactor the event configuration of L3C PMU
  - drivers/perf: hisi: Extend the field of tt_core
  - drivers/perf: hisi: Extract the event filter check of L3C PMU
  - drivers/perf: hisi: Simplify the probe process of each L3C PMU version
  - drivers/perf: hisi: Export hisi_uncore_pmu_isr()
  - drivers/perf: hisi: Relax the event ID check in the framework
  - drivers/perf: hisi: Add support for HiSilicon MN PMU driver
  - drivers/perf: hisi: Add support for HiSilicon NoC PMU
  - drivers/perf: hisi: Support PMUs with no interrupt
  - drivers/perf: hisi: Relax the event number check of v2 PMUs
  - drivers/perf: hisi: Add support for HiSilicon SLLC v3 PMU driver
  - drivers/perf: hisi: Use ACPI driver_data to retrieve SLLC PMU information
  - drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver
  - drivers/perf: hisi: Simplify the probe process for each DDRC version
  - drivers/perf: hisi: Delete redundant blank line of DDRC PMU
  - drivers/perf: hisi: Fix incorrect variable name "hha_pmu" in DDRC PMU driver
  - drivers/perf: hisi: Export associated CPUs of each PMU through sysfs
  - drivers/perf: hisi: Provide a generic implementation of cpumask/identifier
  - drivers/perf: convert sysfs snprintf family to sysfs_emit
  - perf: hisi: Constify static struct attribute_group
  - perf/hisi: Constify static attribute_group structs
  - drivers/perf: hisi: Add a common function to retrieve topology from firmware
  - drivers/perf: hisi: Extract topology information to a separate structure
  - drivers/perf: hisi: Refactor the detection of associated CPUs
  - drivers/perf: hisi: Migrate to one online CPU if no associated one online
  - drivers/perf: hisi: Don't update the associated_cpus on CPU offline
  - drivers/perf: hisi: Define a symbol namespace for HiSilicon Uncore PMUs
  - perf stat: Enable iostat mode for HiSilicon PCIe PMU
  - perf stat: Add struct perf_stat_aggr to perf_stat_evsel
  - perf stat: Display iostat headers correctly
  - perf stat: Don't display metric header for non-leader uncore events
  - perf stat: Basic support for iostat in perf
  - perf arm-spe: Refactor arm-spe to support operation packet type
  - perf arm-spe: Use SPE data source for neoverse cores
  - perf arm-spe: Don't set data source if it's not a memory operation
  - perf tools: Sync addition of PERF_MEM_SNOOPX_PEER
  - tools: arm64: Import sysreg.h
  - smb3: fix for slab out of bounds on mount to ksmbd
  - watchdog/perf: adapt the watchdog_perf interface for async model
  - watchdog/perf: add a weak function for an arch to detect if perf can use NMIs
  - irqchip/gic-v3: Fix a system stall when using pseudo NMI with CONFIG_ARM64_NMI closed
  - irqchip/gic-v3: Fix hard LOCKUP caused by NMI being masked
  - irqchip/gic-v3: Implement FEAT_GICv3_NMI support
  - arm64/nmi: Add Kconfig for NMI
  - arm64/nmi: Add handling of superpriority interrupts as NMIs
  - arm64/irq: Document handling of FEAT_NMI in irqflags.h
  - arm64/entry: Don't call preempt_schedule_irq() with NMIs masked
  - arm64/nmi: Manage masking for superpriority interrupts along with DAIF
  - nvme-fc: use lock accessing port_state and rport state
  - KVM: arm64: Hide FEAT_NMI from guests
  - arm64/cpufeature: Detect PE support for FEAT_NMI
  - arm64/hyp-stub: Enable access to ALLINT
  - arm64/asm: Introduce assembly macros for managing ALLINT
  - arm64/sysreg: Add definitions for immediate versions of MSR ALLINT
  - arm64/booting: Document boot requirements for FEAT_NMI
  - irqchip/gic-v3: Fix priority mask handling
  - irqchip/gic-v3: Refactor ISB + EOIR at ack time
  - irqchip/gicv3-its: Add workaround for HIP09/HIP10/HIP10C/HIP12 erratum 162100803/162200807/162400807/165010802
  - soc cache: Add framework driver for HiSilicon SoC cache


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-301.0.0.204
changelog:
  - !20333 phytium-tpcm-sig-8-hadler-reg-s5000c
  - !20767  Revert hibmc patches to fix null-ptr-deref
  - Revert "!19950 【OLK-5.10】 Drivers GPU Patches from 6.6"
  - Revert "!20738 drm/hisilicon: Using the to_hibmc_drm_private to convert"
  - !20740 cpufeaure: fix the warning of ID_AA64PFR1_NMI_SHIFT
  - cpufeaure: fix the warning of ID_AA64PFR1_NMI_SHIFT
  - !20738 drm/hisilicon: Using the to_hibmc_drm_private to convert
  - drm/hisilicon: Using the to_hibmc_drm_private to convert
  - drm/hisilicon: Code refactoring for hibmc_drm_drv
  - !19010 [OLK-5.10] Drivers for Zhaoxin GMI SM3 & SM4 algorithm
  - !20666  CVE-2023-53712
  - !20673 Fix CVE-2025-39957
  - !20686  Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
  - !20687  i40e: Fix potential invalid access when MAC list is empty
  - !20692  ipv6: sr: Fix MAC comparison to be constant-time
  - !20699  sctp: linearize cloned gso packets in sctp_rcv
  - !20688  tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - !20698  libceph: fix potential use-after-free in have_mon_and_osd_map()
  - !20697  tipc: Fix use-after-free in tipc_mon_reinit_self().
  - sctp: linearize cloned gso packets in sctp_rcv
  - libceph: fix potential use-after-free in have_mon_and_osd_map()
  - tipc: Fix use-after-free in tipc_mon_reinit_self().
  - ipv6: sr: Fix MAC comparison to be constant-time
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - i40e: Fix potential invalid access when MAC list is empty
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
  - !20119 Add 950 KVM feature support
  - !20008 [OLK-5.10] Introduce the Ring Buffer mechanism to accelerate CSV virtual machine migration
  - !20638  ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  - !20637  net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - !20636 v2  macvlan: fix possible UAF in macvlan_forward_source()
  - wifi: mac80211: increase scan_ies_len for S1G
  - !20566  crypto: lzo - Fix compression buffer overrun
  - KVM: arm64: PMU: Avoid inappropriate use of host's PMUVer
  - KVM: arm64: ipiv: Fix compilation warning
  - KVM: arm64: check if IPIV is enabled in BIOS
  - kvm: hisi: print error for IPIV
  - KVM: arm64: using kvm_vgic_global_state for ipiv
  - kvm: hisi: Don't allow to change mpidr in IPIv
  - kvm: hisi: make sure vcpu_id and vcpu_idx have same value in IPIv
  - KVM: arm64: fix live migration bug of IPIv
  - irqchip/gic: Add HiSilicon PV SGI support
  - KVM: arm64: Implement PV_SGI related calls
  - KVM: arm64: Document PV-sgi interface
  - KVM: arm64: Introduce ipiv enable ioctl
  - arm64/config: add config to control whether enable IPIV feature
  - kvm: hisi_virt: Fix compilation error due to missing ACPI configuration
  - kvm: hisi_virt: Probe and configure IPIV capacity on HIP12
  - kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE
  - kvm: hisi_virt: Register ipiv exception interrupt
  - irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule
  - kvm: arm64: avoid sending multi-SGIs in IPIV
  - kvm: hisi_virt: Allocate VM table and save vpeid in it
  - KVM: hisi_virt: tlbi: Fix wrong CPU aff3 conversion between MPIDR and SYS_LSUDVMBM_EL2
  - KVM: arm64: fix memory leak in TLBI
  - KVM: arm64: Add new HiSi CPU type to support DVMBM
  - kvm: hisi_virt: Update TLBI broadcast feature for hip12
  - kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE
  - ARM: 9317/1: kexec: Make smp stop calls asynchronous
  - !20654  scsi: qla4xxx: Prevent a potential error pointer dereference
  - !20653  bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
  - !20655  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - !20656  firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
  - !20274 [Hygon][5.10][Bugfix] Get correct CPU LLC ID in guest for Hygon processors
  - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors
  - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - scsi: qla4xxx: Prevent a potential error pointer dereference
  - bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  - net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - macvlan: fix possible UAF in macvlan_forward_source()
  - !20597  team: fix check for port enabled in team_queue_override_port_prio_changed()
  - !20593  CVE-2025-39744 fixup
  - !20465  SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - !20178 v3  Fix CVE-2024-53179
  - team: fix check for port enabled in team_queue_override_port_prio_changed()
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  - rcu: Use IRQ_WORK_INIT_HARD() to avoid rcu_read_unlock() hangs
  - !20523 [Hygon][5.10][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts
  - !20428  wifi: mt76: do not run mt76u_status_worker if the device is not running
  - !20427  RDMA/bnxt_re: Prevent handling any completions after qp destroy
  - !20466  pptp: ensure minimal skb length in pptp_xmit()
  - !20426  net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  - !20574  RDMA/cm: Fix leaking the multicast GID table reference
  - !20573  media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - !20565 Fix CVE-2023-53521
  - !20521 Fix CVE-2026-23038
  - RDMA/cm: Fix leaking the multicast GID table reference
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - crypto: lzo - Fix compression buffer overrun
  - !20502 [OLK-5.10] backport important bugfix for bnxt driver from upstream linux-5.10.y
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
  - eth: bnxt: move and rename reset helpers
  - x86: Resolve FPU state corruption between atomic and non-atomic contexts
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
  - bnxt_en: Fix potential data corruption with HW GRO/LRO
  - pptp: ensure minimal skb length in pptp_xmit()
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - wifi: mt76: do not run mt76u_status_worker if the device is not running
  - RDMA/bnxt_re: Prevent handling any completions after qp destroy
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  - phytium: add tpcm sgi handler for s5000c
  - smb: client: fix use-after-free of signing key
  - cifs: missed ref-counting smb session in find
  - KVM: SVM: Add RECEIVE_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH
  - KVM: SVM: Add SEND_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH
  - KVM: SVM: Prepare memory pool to allocate buffers for KVM_CSV_COMMAND_BATCH
  - KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode
  - crypto: ccp: Add support for issue commands in CSV RING_BUFFER mode
  - crypto: ccp: Add support to switch to CSV RING_BUFFER mode
  - crypto: ccp: Add support for dequeue status in CSV RING_BUFFER mode
  - crypto: ccp: Add support for enqueue command pointers in CSV RING_BUFFER mode
  - crypto: ccp: Introduce init and free helpers to manage CSV RING_BUFFER queues
  - openeuler_defconfig: Enable CONFIG_CRYPTO_SM*_ZHAOXIN_GMI
  - crypto: Add support for Zhaoxin GMI SM4 Block Cipher Algorithm
  - crypto: Add support for Zhaoxin GMI SM3 Secure Hash algorithm


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-302.0.0.205
changelog:
  - !20737  pNFS: Fix a deadlock when returning a delegation during open()
  - !20725  tracing: Add recursion protection in kernel stack trace recording
  - !20746 Fix CVE-2026-22990
  - !20671  arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
  - !20669  irqchip/gic-v3-its: Avoid truncating memory addresses
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
  - pNFS: Fix a deadlock when returning a delegation during open()
  - tracing: Add recursion protection in kernel stack trace recording
  - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
  - irqchip/gic-v3-its: Avoid truncating memory addresses


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-303.0.0.206
changelog:
  - !20899 Fix CVE-2026-23216
  - !20885  nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  - !20799 RDMA/hns: Remove the accidentally added hns_roce_trace.h file
  - !20839  bpf, cpumap: Make sure kthread is running before map update returns
  - bpf, cpumap: Make sure kthread is running before map update returns
  - !20022 [OLK-5.10] backport irqchip/gic-v4.1: Use local 4_1 ITS to generate VSGI from upstream linux-6.16.rc1
  - !20818  dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - !20801  ACPI/IORT: Add PMCG platform information for 162001900
  - !20814  migrate: correct lock ordering for hugetlb file folios
  - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - !20800  fix CVE-2026-23054
  - migrate: correct lock ordering for hugetlb file folios
  - ACPI/IORT: Add PMCG platform information for 162001900
  - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table
  - hv_netvsc: Allocate rx indirection table size dynamically
  - RDMA/hns: Remove the accidentally added hns_roce_trace.h file
  - irqchip/gic-v4.1: Use local 4_1 ITS to generate VSGI


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-304.0.0.207
changelog:
  - !21136  sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21131  procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - !21075 ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - !21093  kexec: derive purgatory entry from symbol
  - !21140  ksmbd: fix use-after-free in kerberos authentication
  - !21132  SUNRPC: Ensure the transport backchannel association
  - ksmbd: fix use-after-free in kerberos authentication
  - sched/rt: Skip currently executing CPU in rto_next_cpu()
  - SUNRPC: Ensure the transport backchannel association
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - !21112  CVE-2024-57979
  - !21111  ALSA: aloop: Fix racy access at PCM trigger
  - pps: Fix kabi in pps_device
  - pps: Fix a use-after-free
  - ALSA: aloop: Fix racy access at PCM trigger
  - kexec: derive purgatory entry from symbol
  - ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - !21072 v2  arm64/mpam: enable MPAM feature and
  - !20883  RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests
  - !21021  CVE-2026-23209
  - arm64/mpam: fix the bitmap written during mpam device reset
  - arm64/mpam: only allow L3 cache MPAM device created
  - arm64/mpam: fix inadvertently updating after repeatedly updating
  - arm64/mpam: set default feedback of last_cmd_status interface as null string
  - !21000 net: hns3: hns3 driver should be initialized when VF multi tcs is configured
  - !19837 KVM: Drop tlbs_dirty
  - !20773 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - !21014  bpf selftest cross compile fixes
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path
  - macvlan: fix error recovery in macvlan_common_newlink()
  - !21003 [OLK-5.10] backport important bugfix for nvme driver from upstream linux-5.10.y
  - selftests/bpf: Pass target triple to get_sys_includes macro
  - selftests/bpf: Enable cross-building
  - net: hns3: hns3 driver should be initialized when VF multi tcs is configured
  - net: hns3: modify code of judging if SMMU DMA is enabled
  - !20976  support apei_page_offline_policy
  - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page()
  - nvmet-tcp: don't map pages which can't come from HIGHMEM
  - nvmet-tcp: fix regression in data_digest calculation
  - nvmet-tcp: fix memory leak when performing a controller reset
  - !20971 Fix CVE-2026-23074
  - apei/ghes: Add sysctl interface to control soft-offline page isolation
  - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages"
  - !20887  HiSock Enhancement
  - net/sched: Enforce that teql can only be used as root qdisc
  - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - !20891  dcache: Limit the minimal number of bucket to two
  - !20956  CVE-2025-39967
  - fbcon: Fix OOB access in font allocation
  - fbcon: fix integer overflow in fbcon_do_set_font
  - overflow: Allow mixed type arguments
  - nvmet-tcp: add an helper to free the cmd buffers
  - dcache: Limit the minimal number of bucket to two
  - bpf: Deprecate hisock unused helpers and orig ingress logic
  - bpf: Add local connect support for hisock
  - bpf: Add ipv4-mapped ipv6 addr support for hisock
  - bpf: Add target comm parse to hisock_cmd
  - bpf: Add multi port parse to hisock_cmd
  - bpf: Only deploy hisock in server
  - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress
  - bpf: Add bpf_handle_ingress/egress_ptype helper function
  - bpf: Add bpf_set_ingress/egress_dev helper function
  - bpf: Add bpf_get_skb_ethhdr helper function
  - bpf: Add bpf_set_ingress_dst helper function
  - bpf: Add BPF_HISOCK_INGRESS attach type
  - net: move the ptype_all and ptype_base declarations to include/linux/netdevice.h
  - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests
  - KVM: Drop tlbs_dirty


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-305.0.0.208
changelog:
  - !21262  arm64/mpam: Extending MPAM features and bugfix
  - arm64/mpam: Allow MBMIN to be set to 0
  - arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit
  - arm64/mpam: Add quirk to shrink MATA PMG range
  - !21211  scsi: hisi_sas: Change the debugfs parameters dump count default value
  - scsi: hisi_sas: Change the debugfs parameters dump count default value
  - !21163  gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - gic: Add hip09 support for HISILICON_ERRATUM_165010801


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-306.0.0.209
changelog:
  - !21336  arm64/mpam: Add nrdy latency to mbw_rdmon.
  - arm64/mpam: Add nrdy latency to mbw_rdmon.
  - !21243  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  - !20753 [OLK-5.10] Fix the issue that vm can't access to host with virtio-net
  - !21301 [OLK-5.10]:update patches for sw64 architecture
  - !21274  l2tp: fix double dst_release() on sk_dst_cache race
  - !21215 [OLK-5.10] backport important bugfix for nvme driver from upstream linux-6.6.y
  - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled
  - sw64: add support for batched TLB flushing during unmap
  - sw64: fix the parameter passing logic of memblock_mark_nomap
  - sw64: add HUGE_VMAP support for c4
  - sw64: adjust the value of CONFIG_RELOCATION_TABLE_SIZE
  - sw64: define get_cycles macro
  - sw64: cpuidle: refine C6 state stability
  - sw64: fix mmap_base exceeding Java assertion address
  - sw64: add memb before/after atomic
  - sw64: add EDAC support with dynamic node and MC detection
  - sw64: fix: getcpu passed a null pointer error
  - sw64: add barriers and tlb flush for set_atc
  - sw64: adapt kernel page table for kdump
  - sw64: adapt kernel page table for memory hotplug
  - sw64: adjust the marking and definitions of some kernel mapping functions
  - sw64: adapt kernel page table for S4
  - sw64: iommu: refactor iommu v2 initialization
  - sw64: fix an inappropriate lock in __set_memory
  - sw64: cache: fix shared_cpu_map when PPTT is invalid
  - sw64: add alternative runtime patching
  - sw64: pci: fix IO_BASE if numa_off
  - sw64: use ioremap to map spaces for cpufreq and S3
  - sw64: add definitions for kernel-required CPU capabilities
  - sw64: pci: add sunway pci controller for Command Completed errata
  - sw64: kvm: add qemu-gdb watchpoint support
  - sw64: kvm: fix srcu lock leak in pv steal time
  - !21277  mm: make sure freeram is smaller than totalram
  - mm: make sure freeram is smaller than totalram
  - l2tp: fix double dst_release() on sk_dst_cache race
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - vhost: move smp_rmb() into vhost_get_avail_idx()
  - vhost: correct misleading printing information


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-307.0.0.210
changelog:
  - !21428  RDMA/umad: Reject negative data_len in ib_umad_write
  - !21420 v3  CVE-2026-23352
  - !21383  fat: avoid parent link count underflow in rmdir
  - !21435 Fix CVE-2026-23388
  - !21392  ext4: fix memory leak in ext4_ext_shift_extents()
  - !21385  ext4: fix dirtyclusters double decrement on fs shutdown
  - !21384  ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - Squashfs: check metadata block offset is within range
  - RDMA/umad: Reject negative data_len in ib_umad_write
  - !21404  fix queue start/stop imbalance under race
  - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
  - x86/efi: defer freeing of boot services memory
  - dm: fix queue start/stop imbalance under remove/resume races
  - dm: fix queue start/stop imbalance under suspend/load/resume races
  - ext4: fix memory leak in ext4_ext_shift_extents()
  - ext4: fix dirtyclusters double decrement on fs shutdown
  - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - fat: avoid parent link count underflow in rmdir
  - !21376 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization"
  - !21321  nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
  - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-308.0.0.211
changelog:
  - !21578  apparmor: fix unprivileged local user can do privileged policy management
  - !21574  ksmbd: Compare MACs in constant time
  - apparmor: fix unprivileged local user can do privileged policy management
  - !21498  ALSA: usb-audio: Use correct version for UAC3 header validation
  - ksmbd: Compare MACs in constant time
  - !21232 [Hygon][5.10][Feature] spi: dw: Add device HID for Hygon SPI controller
  - !21518  KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
  - !21489  cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_sample()
  - !21455  time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - !21172 [OLK-5.10] Hygon: Update ccp-crypto driver, to support SM4-XTS/GCM and model 10h cpu
  - !21189 [Hygon][5.10][Feature] perf/x86/uncore: Add DF PMU support for Hygon family 18h model 18h
  - !21201 [Hygon][5.10][Feature] hwmon/k10temp: Add support for Hygon family 18h model 18h
  - !21233 [Hygon][5.10][Feature]mmc: sdhci-pci: Add support for Hygon SD controller
  - !21202 [Hygon][5.10][Feature] iommu/hygon: Add support for Hygon family 18h model 18h IOAPIC
  - !21203 [Hygon][5.10][Feature] ALSA: hda: Add support for Hygon family 18h model 18h HD-Audio
  - !21204 [Hygon][5.10][Feature] EDAC/amd64: Add support for Hygon family 18h model 18h
  - !21186 [Hygon][5.10][Feature] x86/amd_nb: Add Hygon family 18h model 18h PCI IDs
  - !21234 [Hygon][5.10][Feature] mmc: sdhci-acpi: Add device HID for Hygon eMMC controller
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
  - spi: dw: Add device HID for Hygon SPI controller
  - !21501 v2  net: usb: pegasus: validate USB endpoints
  - !21467  mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - net: usb: pegasus: validate USB endpoints
  - EDAC/amd64: Add support for Hygon family 18h model 18h
  - ALSA: usb-audio: Use correct version for UAC3 header validation
  - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_sample()
  - !21460  xfs: fix internal error from AGFL exhaustion
  - anolis: mmc: sdhci-acpi: Add device HID for Hygon eMMC controller
  - mmc: sdhci-pci: Add support for Hygon SD controller
  - ALSA: hda: Add support for Hygon family 18h model 18h HD-Audio
  - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - hwmon/k10temp: Add support for Hygon family 18h model 18h
  - iommu/hygon: Add support for Hygon family 18h model 18h IOAPIC
  - perf/x86/uncore: Add DF PMU support for Hygon family 18h model 18h
  - x86/amd_nb: Add Hygon family 18h model 18h PCI IDs
  - xfs: fix internal error from AGFL exhaustion
  - time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - crypto: ccp: fix build issue like redefined RI_XXX_PRESENT
  - crypto: ccp: SM2 ccp encryption support Hygon model 10h
  - crypto: ccp: check if ccp supports sm4-xts/sm4-gcm
  - crypto: ccp: Optimize sm4-gcm algorithm for hygon ccp.
  - crypto: ccp: sm4-xts crypto support data not aligned to 16 bytes
  - crypto: ccp: Support SM4-XTS for hygon ccp
  - crypto: ccp: Support SM4-GCM for hygon ccp


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-309.0.0.212
changelog:
  - !20937 [OLK-5.10] Fix CVE-2025-39788
  - !20902 [OLK-5.10] Fix CVE-2023-53194
  - !20866 [OLK-5.10] Fix CVE-2025-39738
  - !20675 [OLK-5.10] Fix CVE-2025-40205
  - !20599 [OLK-5.10] fix CVE-2025-38476
  - !20611 【OLK-5.10】fix CVE-2025-39794
  - !20838 [OLK-5.10] fix CVE-2022-50518
  - !21749  fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
  - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
  - !21724 RDMA/hns: Support setting GSI QP SL
  - !21590  x86/uprobes: Fix XOL allocation failure for 32-bit tasks
  - !21595  pstore/ram: fix buffer overflow in persistent_ram_save_old()
  - !21708  nfsd: provide locking for v4_end_grace
  - !21469 [Hygon][5.10][Feature]EDAC/amd64: Adjust the maximum number of memory controllers
  - !20238 Fix CVE-2025-68724
  - !21728  media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - !21716  apparmor: validate DFA start states are in bounds in unpack_pdb
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - apparmor: validate DFA start states are in bounds in unpack_pdb
  - nfsd: provide locking for v4_end_grace
  - !21700 RDMA/hns: Fix the panic caused by a large number of print
  - RDMA/hns: Support setting GSI QP SL
  - RDMA/hns: Fix missing CQE when UD QP use different SL
  - RDMA/hns: Fix hung task when drain qp failed.
  - RDMA/hns: Fix the panic caused by a large number of print
  - RDMA/hns: Delete unused bit_size param
  - !21601 Fix CVE-2026-31408
  - !21597 Fix CVE-2026-31393
  - !21673  apparmor: fix race between freeing data and fs accessing it
  - !21603  ice: Fix memory leak in ice_set_ringparam()
  - !21381  bonding: fix use-after-free due to enslave fail after slave array update
  - !21335 Fix CVE-2025-68813
  - apparmor: fix race between freeing data and fs accessing it
  - !21660  apparmor: fix race on rawdata dereference
  - !21647  CVE-2025-39955
  - !21642 Fix CVE-2026-23407
  - !21653  PM: runtime: Fix a race condition related to device removal
  - !21640 Fix CVE-2026-23406
  - !20550 [OLK-5.10] Fix CVE-2022-50300
  - !21620  Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue
  - apparmor: fix race on rawdata dereference
  - !21497  bus: fsl-mc: fix use-after-free in driver_override_show()
  - !21631 Fix CVE-2026-23408
  - PM: runtime: Fix a race condition related to device removal
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
  - !21614  apparmor: replace recursive profile removal with iterative approach
  - !21495  *** fix CVE-2026-23208 ***
  - !21615  apparmor: fix: limit the number of levels of policy namespaces
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  - apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
  - apparmor: fix side-effect bug in match_char() macro usage
  - apparmor: Fix double free of ns_name in aa_replace_profiles()
  - xen/privcmd: add boot control for restricted usage in domU
  - xen/privcmd: unregister xenstore notifier on module exit
  - xen/privcmd: restrict usage in unprivileged domU
  - apparmor: fix: limit the number of levels of policy namespaces
  - apparmor: replace recursive profile removal with iterative approach
  - ice: Fix memory leak in ice_set_ringparam()
  - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  - pstore/ram: fix buffer overflow in persistent_ram_save_old()
  - x86/uprobes: Fix XOL allocation failure for 32-bit tasks
  - EDAC/amd64: Adjust the maximum number of memory controllers per node to 1 for Hygon family 18h model 18h
  - bus: fsl-mc: fix use-after-free in driver_override_show()
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames
  - bonding: fix use-after-free due to enslave fail after slave array update
  - ipvs: fix ipv4 null-ptr-deref in route error path
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
  - parisc: Fix locking in pdc_iodc_print() firmware call
  - fs/ntfs3: Add length check in indx_get_root
  - btrfs: do not allow relocation of partially dropped subvolumes
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  - ARM: tegra: Use I/O memcpy to write to IRAM
  - rpl: Fix use-after-free in rpl_do_srh_inline().
  - btrfs: fix extent map use-after-free when handling missing device in read_one_chunk


author: lingsheng <lingsheng1@h-partners.com> - 3.5.2-9
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: huzhangying <huzhangying@huawei.com> - 1.17.3-43
changelog:
  - Type:CVE
  - CVE:CVE-2025-58183,CVE-2025-58185,CVE-2025-58189,CVE-2025-61724
  - SUG:NA
  - DESC:fix CVE-2025-58183,CVE-2025-58185,CVE-2025-58189,CVE-2025-61724


author: huzhangying <huzhangying@huawei.com> - 1.17.3-47
changelog:
  - Type:CVE
  - CVE:CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61728,CVE-2025-61726,CVE-2025-68121
  - SUG:NA
  - DESC:fix CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61728,CVE-2025-61726,CVE-2025-68121


author: yinsist <jianhui.oerv@isrc.iscas.ac.cn> - 1.6-4
changelog:
  - Valgrind does not support certain architectures like RISC-V, Before depending on Valgrind, first check if Valgrind supports the architecture


author: zhangbinqin<zhangbinqin@h-partners.com> - 8.8p1-36
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix the missing member of the struct Authmethod method_gsskeyex


author: zhangbinqin<zhangbinqin@h-partners.com> - 8.8p1-41
changelog:
  - Type:CVE
  - CVE:CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388
  - SUG:NA
  - DESC:fix CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388


author: <ganqixin@huawei.com> - 10:6.2.0-104
changelog:
  - intel_iommu: Add missed reserved bit check for IEC descriptor
  - 9pfs: fix crash on 'Treaddir' request
  - s390x/ap: fix missing subsystem reset registration
  - qemu/bswap: Undefine CPU_CONVERT() once done
  - linux-user: Add missing signals in strace output
  - linux-user: Add missing clock_gettime64() syscall strace


author: <alex.chen@huawei.com> - 10:6.2.0-105
changelog:
  - target/i386: Add EPYC-Genoa model to support Zen 4 processor series
  - target/i386: Add VNMI and automatic IBRS feature bits
  - target/i386: Add missing feature bits in EPYC-Milan model
  - target/i386: Add feature bits for CPUID_Fn80000021_EAX
  - target/i386: Add a couple of feature bits in 8000_0008_EBX
  - target/i386: Add new EPYC CPU versions with updated cache_info
  - target/i386: allow versioned CPUs to specify new cache_info


author: <fengjiabo1@huawei.com> - 10:6.2.0-106
changelog:
  - hw/nvme: Remove redundant dma_blk_write
  - tests/avocado/machine_s390_ccw_virtio: Adapt test to new default resolution
  - edid: set default resolution to 1280x800 (WXGA)
  - iotests/308: Fix for CAP_DAC_OVERRIDE
  - hvf: remove unused but set variable
  - vvfat: Fix vvfat_write() for writes before the root directory
  - hw/misc/nrf51_rng: Don't use BIT_MASK() when we mean BIT()
  - hw/pci: Remove unused pci_irq_pulse() method
  - ui/gtk: fix leaks found wtih fuzzing
  - target/i386: fix size of EBP writeback in gen_enter()
  - tests/qtest/fuzz: fix memleak in qos_fuzz.c
  - hw/core/loader: gunzip(): fix memory leak on error path
  - migration: fix a typo
  - scsi: fetch unit attention when creating the request
  - raw-format: Fix error message for invalid offset/size
  - tcg: Reset data_gen_ptr correctly
  - Fix calculation of minimum in colo_compare_tcp
  - hw/intc: Don't clear pending bits on IRQ lowering
  - target/arm: Drop user-only special case in sve_stN_r
  - usb-hub: Fix handling port power control messages
  - target/ppc: Set ctx->opcode for decode_insn32()
  - linux-user: Add proper strace format strings for getdents()/getdents64()
  - linux-user: Fix TARGET_PROT_SEM for XTENSA
  - linux-user/hppa: Set TASK_UNMAPPED_BASE to 0xfa000000 for hppa arch
  - linux-user/hppa: Dump IIR on register dump
  - tests: Fix typo in check-help output
  - qdev-core.h: Fix wrongly named reference to TYPE_SPLIT_IRQ
  - hw/scsi/megasas: Simplify using the ldst API
  - gqa-win: get_pci_info: Clean dev_info if handle is valid
  - target/ppc: Fix 7448 support
  - vvfat: Fix size of temporary qcow file
  - docs: Correct 'vhost-user-blk' spelling
  - jackaudio: use ifdefs to hide unavailable functions
  - simplebench: Fix Python syntax error (reported by LGTM)
  - python: update type hints for mypy 0.930
  - Python/aqmp: fix type definitions for mypy 0.920
  - tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc()
  - hw/ppc/e500: Prefer QOM cast
  - hw/ppc/e500: Remove unused "irqs" parameter
  - hw/ppc/e500: Add missing device tree properties to i2c controller node
  - linux-user: Show timespec on strace for futex()
  - linux-user: Add strace for clock_nanosleep()
  - linux-user: Fix strace of chmod() if mode == 0
  - linux-user: Log failing executable in EXCP_DUMP()
  - linux-user: Add pidfd_open(), pidfd_send_signal() and pidfd_getfd() syscalls


author: <fengjiabo1@huawei.com> - 10:6.2.0-107
changelog:
  - qemu: Support specifying the cache size presented to guest
  - hw/core/machine-smp: Initialize caches_bitmap before reading
  - qapi/qom: Define cache enumeration and properties for machine
  - linux-aio: fix unbalanced plugged counter in laio_io_unplug()


author: <fengjiabo1@huawei.com> - 10:6.2.0-109
changelog:
  - migration:Extand the fdtable in the incoming phase of migration
  - qemu6.2.0: Add trace to measure hot migrate downtime


author: Pengrui Zhang <zhangpengrui@huawei.com> - 10:6.2.0-111
changelog:
  - target/i386: Add Hygon Dhyana-v3 CPU model
  - target/i386: Add new Hygon 'Dharma' CPU model
  - migration: Don't sync volatile memory after migration completes
  - hw/display/framebuffer: Add cast to force 64x64 multiply
  - vmxcap: Add 5-level EPT bit
  - i386: Add Icelake-Server-v6 CPU model with 5-level EPT support
  - vmxcap: add tertiary execution controls
  - target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE
  - target/i386: enumerate bit 56 of MSR_IA32_VMX_BASIC
  - target/i386: fix feature dependency for WAITPKG
  - target/i386: add support for LAM in CPUID enumeration
  - target/i386: add control bits support for LAM
  - target/i386: add support for FRED in CPUID enumeration
  - target/i386: mark CR4.FRED not reserved
  - vmxcap: add support for VMX FRED controls
  - target/i386: enumerate VMX nested-exception support
  - target/i386: Add get/set/migrate support for FRED MSRs
  - target/i386: Delete duplicated macro definition CR4_FRED_MASK
  - target/i386: Add VMX control bits for nested FRED support
  - target/i386: Raise the highest index value used for any VMCS encoding
  - target/i386: Add more features enumerated by CPUID.7.2.EDX
  - target/i386: pass X86CPU to x86_cpu_get_supported_feature_word
  - i386/cpuid: Remove subleaf constraint on CPUID leaf 1F
  - target/i386: Don't construct a all-zero entry for CPUID[0xD 0x3f]
  - target/i386: Enable fdp-excptn-only and zero-fcs-fds
  - target/i386: Construct CPUID 2 as stateful iff times > 1
  - target/i386: Make invtsc migratable when user sets tsc-khz explicitly
  - target/i386/cpu: Fix notes for CPU models
  - target/i386: Introduce SierraForest-v2 model
  - target/i386: Export BHI_NO bit to guests
  - target/i386: Add new CPU model ClearwaterForest
  - docs: Add GNR, SRF and CWF CPU models
  - target/i386: add sha512, sm3, sm4 feature bits
  - target/i386: add avx-vnni-int16 feature
  - net: pad packets to minimum length in qemu_receive_packet()(CVE-2025-12464)
  - block-qdict: Fix-Werror=maybe-uninitialized build failure
  - block/curl.c: Check error return from curl_easy_setopt()
  - block: Handle curl 7.55.0..7.85.0 version changes
  - amd_iommu: fix uninitialized werror
  - io: release active GSource in TLS channel finalizer
  - io: move websocket resource release to close method
  - io: fix use after free in websocket handshake code(CVE-2025-11234)


author: Pengrui Zhang <zhangpengrui@huawei.com> - 10:6.2.0-113
changelog:
  - cryptodev-builtin: Limit the maximum size(CVE-2025-14876)
  - block/vmdk: fix OOB read in vmdk_read_extent()(CVE-2026-2243)
  - lsi53c895a: keep a reference to the device while SCRIPTS execute(CVE-2024-6519)


author: wjiang <app@cameyan.com> - 249-108
changelog:
  - backport community patches:
        backport-login-user-runtime-dir-free-ignored-sd_bus_error-avo.patch
        backport-login-user-runtime-dir-use-STRLEN-where-appropriate.patch
        backport-systemctl-gracefully-adjust-bus-transport-and-runtim.patch
        backport-journal-do-not-rotate-journal-when-MaxRetentionSec-i.patch
        backport-compress-avoid-a-bunch-of-div-by-zeroes.patch


author: yixiangzhike <yixiangzhike007@163.com> - 249-110
changelog:
  - fix coredump generation when systemd-resolved and systemd-networkd service is started then uninstalled


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


