# changelog

author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-305.0.0.208
changelog:
  - !21262  arm64/mpam: Extending MPAM features and bugfix
  - arm64/mpam: Allow MBMIN to be set to 0
  - arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit
  - arm64/mpam: Add quirk to shrink MATA PMG range
  - !21211  scsi: hisi_sas: Change the debugfs parameters dump count default value
  - scsi: hisi_sas: Change the debugfs parameters dump count default value
  - !21163  gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - gic: Add hip09 support for HISILICON_ERRATUM_165010801


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-306.0.0.209
changelog:
  - !21336  arm64/mpam: Add nrdy latency to mbw_rdmon.
  - arm64/mpam: Add nrdy latency to mbw_rdmon.
  - !21243  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  - !20753 [OLK-5.10] Fix the issue that vm can't access to host with virtio-net
  - !21301 [OLK-5.10]:update patches for sw64 architecture
  - !21274  l2tp: fix double dst_release() on sk_dst_cache race
  - !21215 [OLK-5.10] backport important bugfix for nvme driver from upstream linux-6.6.y
  - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled
  - sw64: add support for batched TLB flushing during unmap
  - sw64: fix the parameter passing logic of memblock_mark_nomap
  - sw64: add HUGE_VMAP support for c4
  - sw64: adjust the value of CONFIG_RELOCATION_TABLE_SIZE
  - sw64: define get_cycles macro
  - sw64: cpuidle: refine C6 state stability
  - sw64: fix mmap_base exceeding Java assertion address
  - sw64: add memb before/after atomic
  - sw64: add EDAC support with dynamic node and MC detection
  - sw64: fix: getcpu passed a null pointer error
  - sw64: add barriers and tlb flush for set_atc
  - sw64: adapt kernel page table for kdump
  - sw64: adapt kernel page table for memory hotplug
  - sw64: adjust the marking and definitions of some kernel mapping functions
  - sw64: adapt kernel page table for S4
  - sw64: iommu: refactor iommu v2 initialization
  - sw64: fix an inappropriate lock in __set_memory
  - sw64: cache: fix shared_cpu_map when PPTT is invalid
  - sw64: add alternative runtime patching
  - sw64: pci: fix IO_BASE if numa_off
  - sw64: use ioremap to map spaces for cpufreq and S3
  - sw64: add definitions for kernel-required CPU capabilities
  - sw64: pci: add sunway pci controller for Command Completed errata
  - sw64: kvm: add qemu-gdb watchpoint support
  - sw64: kvm: fix srcu lock leak in pv steal time
  - !21277  mm: make sure freeram is smaller than totalram
  - mm: make sure freeram is smaller than totalram
  - l2tp: fix double dst_release() on sk_dst_cache race
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - vhost: move smp_rmb() into vhost_get_avail_idx()
  - vhost: correct misleading printing information


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-307.0.0.210
changelog:
  - !21428  RDMA/umad: Reject negative data_len in ib_umad_write
  - !21420 v3  CVE-2026-23352
  - !21383  fat: avoid parent link count underflow in rmdir
  - !21435 Fix CVE-2026-23388
  - !21392  ext4: fix memory leak in ext4_ext_shift_extents()
  - !21385  ext4: fix dirtyclusters double decrement on fs shutdown
  - !21384  ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - Squashfs: check metadata block offset is within range
  - RDMA/umad: Reject negative data_len in ib_umad_write
  - !21404  fix queue start/stop imbalance under race
  - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
  - x86/efi: defer freeing of boot services memory
  - dm: fix queue start/stop imbalance under remove/resume races
  - dm: fix queue start/stop imbalance under suspend/load/resume races
  - ext4: fix memory leak in ext4_ext_shift_extents()
  - ext4: fix dirtyclusters double decrement on fs shutdown
  - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - fat: avoid parent link count underflow in rmdir
  - !21376 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization"
  - !21321  nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
  - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-308.0.0.211
changelog:
  - !21578  apparmor: fix unprivileged local user can do privileged policy management
  - !21574  ksmbd: Compare MACs in constant time
  - apparmor: fix unprivileged local user can do privileged policy management
  - !21498  ALSA: usb-audio: Use correct version for UAC3 header validation
  - ksmbd: Compare MACs in constant time
  - !21232 [Hygon][5.10][Feature] spi: dw: Add device HID for Hygon SPI controller
  - !21518  KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
  - !21489  cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_sample()
  - !21455  time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - !21172 [OLK-5.10] Hygon: Update ccp-crypto driver, to support SM4-XTS/GCM and model 10h cpu
  - !21189 [Hygon][5.10][Feature] perf/x86/uncore: Add DF PMU support for Hygon family 18h model 18h
  - !21201 [Hygon][5.10][Feature] hwmon/k10temp: Add support for Hygon family 18h model 18h
  - !21233 [Hygon][5.10][Feature]mmc: sdhci-pci: Add support for Hygon SD controller
  - !21202 [Hygon][5.10][Feature] iommu/hygon: Add support for Hygon family 18h model 18h IOAPIC
  - !21203 [Hygon][5.10][Feature] ALSA: hda: Add support for Hygon family 18h model 18h HD-Audio
  - !21204 [Hygon][5.10][Feature] EDAC/amd64: Add support for Hygon family 18h model 18h
  - !21186 [Hygon][5.10][Feature] x86/amd_nb: Add Hygon family 18h model 18h PCI IDs
  - !21234 [Hygon][5.10][Feature] mmc: sdhci-acpi: Add device HID for Hygon eMMC controller
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
  - spi: dw: Add device HID for Hygon SPI controller
  - !21501 v2  net: usb: pegasus: validate USB endpoints
  - !21467  mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - net: usb: pegasus: validate USB endpoints
  - EDAC/amd64: Add support for Hygon family 18h model 18h
  - ALSA: usb-audio: Use correct version for UAC3 header validation
  - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_sample()
  - !21460  xfs: fix internal error from AGFL exhaustion
  - anolis: mmc: sdhci-acpi: Add device HID for Hygon eMMC controller
  - mmc: sdhci-pci: Add support for Hygon SD controller
  - ALSA: hda: Add support for Hygon family 18h model 18h HD-Audio
  - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - hwmon/k10temp: Add support for Hygon family 18h model 18h
  - iommu/hygon: Add support for Hygon family 18h model 18h IOAPIC
  - perf/x86/uncore: Add DF PMU support for Hygon family 18h model 18h
  - x86/amd_nb: Add Hygon family 18h model 18h PCI IDs
  - xfs: fix internal error from AGFL exhaustion
  - time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - crypto: ccp: fix build issue like redefined RI_XXX_PRESENT
  - crypto: ccp: SM2 ccp encryption support Hygon model 10h
  - crypto: ccp: check if ccp supports sm4-xts/sm4-gcm
  - crypto: ccp: Optimize sm4-gcm algorithm for hygon ccp.
  - crypto: ccp: sm4-xts crypto support data not aligned to 16 bytes
  - crypto: ccp: Support SM4-XTS for hygon ccp
  - crypto: ccp: Support SM4-GCM for hygon ccp


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-309.0.0.212
changelog:
  - !20937 [OLK-5.10] Fix CVE-2025-39788
  - !20902 [OLK-5.10] Fix CVE-2023-53194
  - !20866 [OLK-5.10] Fix CVE-2025-39738
  - !20675 [OLK-5.10] Fix CVE-2025-40205
  - !20599 [OLK-5.10] fix CVE-2025-38476
  - !20611 【OLK-5.10】fix CVE-2025-39794
  - !20838 [OLK-5.10] fix CVE-2022-50518
  - !21749  fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
  - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
  - !21724 RDMA/hns: Support setting GSI QP SL
  - !21590  x86/uprobes: Fix XOL allocation failure for 32-bit tasks
  - !21595  pstore/ram: fix buffer overflow in persistent_ram_save_old()
  - !21708  nfsd: provide locking for v4_end_grace
  - !21469 [Hygon][5.10][Feature]EDAC/amd64: Adjust the maximum number of memory controllers
  - !20238 Fix CVE-2025-68724
  - !21728  media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - !21716  apparmor: validate DFA start states are in bounds in unpack_pdb
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - apparmor: validate DFA start states are in bounds in unpack_pdb
  - nfsd: provide locking for v4_end_grace
  - !21700 RDMA/hns: Fix the panic caused by a large number of print
  - RDMA/hns: Support setting GSI QP SL
  - RDMA/hns: Fix missing CQE when UD QP use different SL
  - RDMA/hns: Fix hung task when drain qp failed.
  - RDMA/hns: Fix the panic caused by a large number of print
  - RDMA/hns: Delete unused bit_size param
  - !21601 Fix CVE-2026-31408
  - !21597 Fix CVE-2026-31393
  - !21673  apparmor: fix race between freeing data and fs accessing it
  - !21603  ice: Fix memory leak in ice_set_ringparam()
  - !21381  bonding: fix use-after-free due to enslave fail after slave array update
  - !21335 Fix CVE-2025-68813
  - apparmor: fix race between freeing data and fs accessing it
  - !21660  apparmor: fix race on rawdata dereference
  - !21647  CVE-2025-39955
  - !21642 Fix CVE-2026-23407
  - !21653  PM: runtime: Fix a race condition related to device removal
  - !21640 Fix CVE-2026-23406
  - !20550 [OLK-5.10] Fix CVE-2022-50300
  - !21620  Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue
  - apparmor: fix race on rawdata dereference
  - !21497  bus: fsl-mc: fix use-after-free in driver_override_show()
  - !21631 Fix CVE-2026-23408
  - PM: runtime: Fix a race condition related to device removal
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
  - !21614  apparmor: replace recursive profile removal with iterative approach
  - !21495  *** fix CVE-2026-23208 ***
  - !21615  apparmor: fix: limit the number of levels of policy namespaces
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  - apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
  - apparmor: fix side-effect bug in match_char() macro usage
  - apparmor: Fix double free of ns_name in aa_replace_profiles()
  - xen/privcmd: add boot control for restricted usage in domU
  - xen/privcmd: unregister xenstore notifier on module exit
  - xen/privcmd: restrict usage in unprivileged domU
  - apparmor: fix: limit the number of levels of policy namespaces
  - apparmor: replace recursive profile removal with iterative approach
  - ice: Fix memory leak in ice_set_ringparam()
  - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  - pstore/ram: fix buffer overflow in persistent_ram_save_old()
  - x86/uprobes: Fix XOL allocation failure for 32-bit tasks
  - EDAC/amd64: Adjust the maximum number of memory controllers per node to 1 for Hygon family 18h model 18h
  - bus: fsl-mc: fix use-after-free in driver_override_show()
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames
  - bonding: fix use-after-free due to enslave fail after slave array update
  - ipvs: fix ipv4 null-ptr-deref in route error path
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
  - parisc: Fix locking in pdc_iodc_print() firmware call
  - fs/ntfs3: Add length check in indx_get_root
  - btrfs: do not allow relocation of partially dropped subvolumes
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  - ARM: tegra: Use I/O memcpy to write to IRAM
  - rpl: Fix use-after-free in rpl_do_srh_inline().
  - btrfs: fix extent map use-after-free when handling missing device in read_one_chunk


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-310.0.0.213
changelog:
  - !21832  smb: client: fix krb5 mount with username option
  - !21838  ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
  - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
  - smb: client: fix krb5 mount with username option
  - !21801 Fix CVE-2026-23450
  - !21800 Fix CVE-2025-71078
  - !21505 crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - !21811 RDMA/hns: Fix warning in poll cq direct mode
  - !21758  nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  - RDMA/hns: Fix warning in poll cq direct mode
  - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
  - powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - !21766  Fix CVE-2026-23271
  - perf: Fix Wdeclaration-after-statement
  - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  - crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - crypto: hisilicon/qm - add concurrency protection for variable err_threshold


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-311.0.0.214
changelog:
  - !22036 drivers:misc:sdma-dae: Write the CQ head pointer correctly.
  - drivers:misc:sdma-dae: Write the CQ head pointer correctly.
  - !21966  netfilter: nf_tables: unconditionally bump set->nelems before insertion
  - !21965  net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
  - !21968  netfilter: xt_CT: drop pending enqueued packets on template removal
  - !21967  netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  - !21964  netfilter: Fix CVE-2026-23351
  - !21963 v2  bonding: limit BOND_MODE_8023AD to Ethernet devices
  - !21983 Fix CVE-2026-23383
  - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
  - netfilter: xt_CT: drop pending enqueued packets on template removal
  - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  - netfilter: nf_tables: unconditionally bump set->nelems before insertion
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
  - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
  - netfilter: nf_tables: de-constify set commit ops function argument
  - bonding: limit BOND_MODE_8023AD to Ethernet devices
  - !21936 drivers:misc:sdma-dae: Remove interference print.
  - drivers:misc:sdma-dae: Remove interference print.
  - !21901 [Hygon][5.10][bugfix] Fix switch_kernel_fpu_prepare in Hygon non-atomic NT copy path
  - !21896 driver/misc/sdma-dae:Resolve conflicts between NCOB and SDMA
  - drivers:misc:sdma-dae: Checking the address alignment
  - !21897 Fix CVE-2026-31473
  - x86/fpu: fix wrong thread_flag check in switch_kernel_fpu_prepare
  - x86/copy_user_avx2: add sfence before vzeroupper in fixup path
  - !21877 net: hns3: Clear the static alarm about 'implicit type conversion'
  - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
  - net: hns3: Clear the static alarm about 'implicit type conversion'
  - net: hns3: Clear the static alarm about 'no previous prototype'
  - net: hns3: Clear the static alarm about discarding the 'const' qualifier
  - net: hns3: set the freed pointer to NULL
  - net: hns3: fix wrong location of HCLGE_FD_AD_QID_H_B


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-312.0.0.215
changelog:
  - !22139  Fix CVE-2026-31431
  - crypto: algif_aead - Fix minimum RX size check for decryption
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
  - crypto: authencesn - Fix src offset when decrypting in-place
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
  - crypto: authenc - use memcpy_sglist() instead of null skcipher
  - crypto: algif_aead - snapshot IV for async AEAD requests
  - crypto: algif_aead - Revert to operating out-of-place
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  - crypto: scatterwalk - Backport memcpy_sglist()
  - crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  - !22064 CVE-2026-31504
  - !22058 CVE-2026-31515
  - !22007 Fix CVE-2026-31677
  - crypto: af_alg - limit RX SG extraction by receive buffer budget
  - net: fix fanout UAF in packet_release() via NETDEV_UP race
  - !21871 [Hygon][5.10][Feature] pwm: dwc: Add support for Hygon pwm controller
  - !21982 Backport the patch that fix whitespace in sev_cmd_buffer_len() from upstream.
  - af_key: validate families in pfkey_send_migrate()
  - crypto: ccp - Fix whitespace in sev_cmd_buffer_len()
  - pwm: dwc: Add support for Hygon pwm controller
  - openeuler_defconfig: Add CONFIG_PWM_DWC
  - pwm: Add DesignWare PWM Controller Driver


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-313.0.0.216
changelog:
  - !22057 Fix CVE-2026-31590
  - !21943 Fix CVE-2026-31450
  - !21988  Fix CVE-2026-31449
  - !21118 [OLK-5.10] Fix CVE-2025-68340
  - !22045  ALSA: ctxfi: Limit PTP to a single page
  - !22100  KVM: x86: Use scratch field in MMIO fragment to hold small write values
  - !21944  media: dvb-net: fix OOB access in ULE extension header tables
  - !22099 Fix CVE-2026-31678
  - !22070 CVE-2026-31673
  - !22068 CVE-2026-31674
  - !22067 CVE-2026-31680
  - !22065 CVE-2026-31682
  - !22073 CVE-2026-31570
  - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
  - KVM: x86: Use scratch field in MMIO fragment to hold small write values
  - openvswitch: defer tunnel netdev_put to RCU release
  - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
  - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
  - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
  - bridge: br_nd_send: linearize skb before parsing ND options
  - ALSA: ctxfi: Limit PTP to a single page
  - ext4: validate p_idx bounds in ext4_ext_correct_indexes
  - ext4: prevent partial update of the extents path
  - ext4: refactor ext4_ext_rm_idx() to index 'path'
  - media: dvb-net: fix OOB access in ULE extension header tables
  - ext4: publish jinode after initialization
  - team: Move team device type change at the end of team_port_add


author: Tengda Wu <wutengda2@huawei.com> - 5.10.0-314.0.0.217
changelog:
  - !22409  CVE
  - !22408  *** fix CVE-2026-31527 ***
  - !22423  ALSA: ctxfi: Check the error for index mapping
  - ALSA: ctxfi: Check the error for index mapping
  - !22405  dmaengine: idxd: Fix not releasing workqueue on .release()
  - !22389  Fix CVE-2025-38680
  - !22373  fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - HID: core: Mitigate potential OOB by removing bogus memset()
  - HID: core: Add printk_ratelimited variants to hid_warn() etc
  - HID: multitouch: Check to ensure report responses match the request
  - Bluetooth: MGMT: validate LTK enc_size on load
  - driver/core: Fix kabi broken of platform_device/device/bus_type
  - driver core: platform: use generic driver_override infrastructure
  - hwmon: axi-fan: don't use driver_override as IRQ name
  - driver core: generalize driver_override in struct device
  - !22299  ALSA: fireworks: bound device-supplied status before string array lookup
  - dmaengine: idxd: Fix not releasing workqueue on .release()
  - !22354  Bluetooth: SMP: derive legacy responder STK authentication from MITM state
  - !22337  HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
  - !22273  EFI/CPER: don't dump the entire memory region
  - !22366  Input: uinput - fix circular locking dependency with ff-core
  - !22344  rxrpc: proc: size address buffers for %pISpc output
  - !22357  dmaengine: idxd: Fix memory leak when a wq is reset
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - !22328  ALSA: caiaq: fix stack out-of-bounds read in init_card
  - !22279 Fix CVE-2026-31699
  - !22277  crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
  - Input: uinput - fix circular locking dependency with ff-core
  - dmaengine: idxd: Fix memory leak when a wq is reset
  - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
  - rxrpc: proc: size address buffers for %pISpc output
  - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
  - !22297 Fix CVE-2026-23317
  - !20491  scsi: leapraid: add RAID disk hide/show events and fix misc issues
  - ALSA: caiaq: fix stack out-of-bounds read in init_card
  - !22303  module: Fix kernel panic when a symbol st_shndx is out of bounds
  - !22318  drm/ioc32: stop speculation on the drm_compat_ioctl path
  - !22231 Revert "[cpufreq]Fix re-boost issue after hotplugging a CPU"
  - !22230  cpufreq: conservative: Reset requested_freq on limits change
  - drm/ioc32: stop speculation on the drm_compat_ioctl path
  - !22293 Fix CVE-2026-43407
  - module: Fix kernel panic when a symbol st_shndx is out of bounds
  - ALSA: fireworks: bound device-supplied status before string array lookup
  - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
  - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
  - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
  - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
  - !22225  bpf: Fix regsafe() for pointers to packet
  - !22263 CVE-2026-31419
  - !22237 Fix CVE-2026-31697
  - EFI/CPER: don't dump the entire memory region
  - !21864 Backport the patch that add support for SEV attestation command
  - bonding: remove unused bond_is_first_slave and bond_is_last_slave macros
  - net: bonding: fix use-after-free in bond_xmit_broadcast()
  - bonding: do not set usable_slaves for broadcast mode
  - net: bonding: update the slave array for broadcast mode
  - !22132 Ethernet: Linkdata: Supports Linkdata ethernet Controllers
  - !22253 [OLK-5.10] Fix CVE-2026-43284
  - Ethernet: Linkdata: Supports Linkdata ethernet Controllers
  - xfrm: esp: avoid in-place decrypt on shared skb frags
  - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
  - Revert "[cpufreq]Fix re-boost issue after hotplugging a CPU"
  - cpufreq: conservative: Reset requested_freq on limits change
  - bpf: Fix regsafe() for pointers to packet
  - !22214  futex: Clear stale exiting pointer in futex_lock_pi() retry path
  - !22205  pstore: ram_core: fix incorrect success return when vmap() fails
  - !22207  perf/x86/intel/uncore: Skip discovery table for offline dies
  - !22211  usb: cdns3: gadget: fix state inconsistency on gadget init failure
  - !22216  x86/CPU: Fix FPDSS on Zen1
  - !22186 Fix CVE-2026-31679
  - x86/CPU: Fix FPDSS on Zen1
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path
  - usb: cdns3: gadget: fix state inconsistency on gadget init failure
  - !22174 Fix CVE-2026-31592
  - !22094  NFSD: Defer sub-object cleanup in export put callbacks
  - !22102  NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
  - !21933  ksmbd: do not expire session on binding failure
  - !21927  nvme-pci: ensure we're polling a polled queue
  - !21925  ext4: avoid infinite loops caused by residual data
  - !22169  xen/privcmd: fix double free via VMA splitting
  - !22168  Buffer overflow in drivers/xen/sys-hypervisor.c
  - !22163  spi: spi-dw-dma: fix print error log when wait finish transaction
  - perf/x86/intel/uncore: Skip discovery table for offline dies
  - pstore: ram_core: fix incorrect success return when vmap() fails
  - openvswitch: validate MPLS set/set_masked payload length
  - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
  - xen/privcmd: fix double free via VMA splitting
  - Buffer overflow in drivers/xen/sys-hypervisor.c
  - spi: spi-dw-dma: fix print error log when wait finish transaction
  - KVM/SVM: add support for SEV attestation command
  - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
  - NFSD: Defer sub-object cleanup in export put callbacks
  - ksmbd: do not expire session on binding failure
  - nvme-pci: ensure we're polling a polled queue
  - ext4: avoid infinite loops caused by residual data
  - scsi: leapraid: add RAID disk hide/show events and fix misc issues


author: liuxu <liuxu156@huawei.com> - 1:1.34.1-21
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: Funda Wang <fundawang@yeah.net> - 140.7.0-1
changelog:
  - update to 140.7.0
    * fix CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,
      CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,
      CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,
      CVE-2026-0891


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-22
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: xingwei <xingwei14@h-partners.com> - 2.4.51-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mod_log_config: Fix LogFormat directive merging
         Fix X509 leak and Increase MAX_CONCURRENCY hard limit
         mod_proxy_balancer: Fix the handling of the stickysession
         mod_cache_socache: Fix possible crash on error path
         mod_ssl: Check SSL_CTX_new() return value
         core: Report invalid Options argument when parsing AllowOverride directives


author: yanglu <yanglu72@h-partners.com> - 2.4.51-25
changelog:
  - Type:CVE
  - CVE:CVE-2025-49812,CVE-2025-23048,CVE-2024-47252,CVE-2024-43204,CVE-2024-42516
  - SUG:NA
  - DESC:fix CVE-2025-49812 CVE-2025-23048 CVE-2024-47252 CVE-2024-43204 CVE-2024-42516
         mod_lua: Fix memory handling in output filters.
         Fix a regression that caused stickysession keys
         avoid ap_set_content_type when processing a _Request_Header
         set_cookie_name: ensure correct format


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.4.51-26
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:mod_proxy: SetEnv proxy-nohalfclose to disable half-close tunneling


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.4.51-27
changelog:
  - Type:CVE
  - CVE:CVE-2025-58098,CVE-2025-65082,CVE-2025-55753,CVE-2025-66200
  - SUG:NA
  - DESC:SSI request judgment
         Request header similarity detection
         fix mod_mod error retry delay calculation to not already doubling the wait on the first error.
         stop accepting "note" in RequestHeader.


author: tangce <tangce1@h-partners.com> - 2.4.51-29
changelog:
  - Type:CVE
  - CVE:CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059
  - SUG:NA
  - DESC:fix CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059


author: zhangbinqin <zhangbinqin@h-partners.com> - 1.10.0-8
changelog:
  - Type:CVE
  - CVE:CVE-2026-7598
  - SUG:NA
  - DESC:add username_len bounds checking to fix CVE-2026-7598


author: Funda Wang <fundawang@yeah.net> - 8.0.30-7
changelog:
  - Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
    GHSA-4w77-75f9-2c8w
  - Fix OOB access in ldap_escape
    CVE-2024-8932
  - Fix Integer overflow in the dblib/firebird quoter causing OOB writes
    CVE-2024-11236
  - Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs
    CVE-2024-11234
  - Fix Single byte overread with convert.quoted-printable-decode filter
    CVE-2024-11233


author: Funda Wang <fundawang@yeah.net> - 8.0.30-11
changelog:
  - Fix Null byte termination in dns_get_record()
    GHSA-www2-q4fc-65wf
  - Fix Heap buffer overflow in array_merge()
    CVE-2025-14178
  - Fix Information Leak of Memory in getimagesize
    CVE-2025-14177


author: Funda Wang <fundawang@yeah.net> - 8.0.30-12
changelog:
  - Fix Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
    CVE-2026-7259
  - Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
    CVE-2026-6722
  - Fix Broken Apache map value NULL check
    CVE-2026-7262
  - Fix Signed integer overflow of char array offset
    CVE-2026-7568


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


